vscode-markdown-preview-enhanced vulnerabilities
3 known vulnerabilities in vscode-markdown-preview-enhanced from Shd101wyy. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
vscode-markdown-preview-enhanced: Exposed Dangerous Method or Function
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _cr
- 8.5 High severity
vscode-markdown-preview-enhanced: Improper Control of Generation of Code
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a s
- 8.8 High severity
vscode-markdown-preview-enhanced: Improper Neutralization of Special Elements used in an OS Command
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exe