CVE-2026-54525

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions prior to 0.8.28

Description Improper neutralization of special elements in the preview-link handling of the Markdown Preview Enhanced extension for Visual Studio Code allows remote code execution. When a user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, the extension passes a decoded link target to a Windows file-opening helper. This helper invokes child process.exec() using the start command, causing shell metacharacters in the target to be interpreted by cmd.exe as command separators. This enables the execution of attacker-selected commands with the privileges of the current Visual Studio Code user.

Recommendations Update to version 0.8.28.