Summary
Markdown Preview Enhanced for Visual Studio Code contains a command injection flaw in its Windows preview-link handling. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, attacker-controlled shell metacharacters may cause commands to run with the privileges of the current VS Code user.
Markdown Preview Enhanced for Visual Studio Code contains a command injection flaw in its Windows preview-link handling. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, attacker-controlled shell metacharacters may cause commands to run with the privileges of the current VS Code user.
Affected context
The vulnerability occurs in the Windows-specific handling of links opened from Markdown Preview Enhanced previews. It becomes risky when an untrusted Markdown document contains a link target that is decoded and passed to a shell-based file-opening helper. Exploitation depends on a user opening the preview and clicking the crafted link.
The vulnerability occurs in the Windows-specific handling of links opened from Markdown Preview Enhanced previews. It becomes risky when an untrusted Markdown document contains a link target that is decoded and passed to a shell-based file-opening helper. Exploitation depends on a user opening the preview and clicking the crafted link.
Exploit preconditions
- Attack surface: Markdown Preview Enhanced link handling on Windows
- Required access: Ability to provide or cause the victim to open an untrusted Markdown file
- Trigger point: A user click on a crafted external or unsupported-scheme preview link
- Why exploitation is possible: The decoded link target reaches a shell command without adequate separation from command syntax, allowing
cmd.exemetacharacters to be interpreted as command separators
- Attack surface: Markdown Preview Enhanced link handling on Windows
- Required access: Ability to provide or cause the victim to open an untrusted Markdown file
- Trigger point: A user click on a crafted external or unsupported-scheme preview link
- Why exploitation is possible: The decoded link target reaches a shell command without adequate separation from command syntax, allowing
cmd.exemetacharacters to be interpreted as command separators
Why this happens
The underlying bug is an OS command injection condition caused by passing attacker-influenced link data to a shell through child_process.exec and the Windows start command. Because the decoded target is treated as part of a shell command rather than as inert data or a safely separated process argument, shell metacharacters can alter command interpretation. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The underlying bug is an OS command injection condition caused by passing attacker-influenced link data to a shell through child_process.exec and the Windows start command. Because the decoded target is treated as part of a shell command rather than as inert data or a safely separated process argument, shell metacharacters can alter command interpretation. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An attacker-selected command may execute with the privileges of the current VS Code user
- The attacker could access, modify, or delete data available to that user
- Workspace or development credentials could be exposed
- The compromise could be used for persistence or further lateral movement
- Developer systems and software supply-chain assets could be affected
- An attacker-selected command may execute with the privileges of the current VS Code user
- The attacker could access, modify, or delete data available to that user
- Workspace or development credentials could be exposed
- The compromise could be used for persistence or further lateral movement
- Developer systems and software supply-chain assets could be affected
General mitigation guidance
Mitigation generally focuses on preventing untrusted link data from reaching a command shell.
Common defensive patterns include:
- Prefer direct process-spawning APIs that pass arguments separately instead of shell-evaluated command strings
- Use a strict allowlist of supported URL schemes and reject unsupported or ambiguous targets
- Treat decoded Markdown link targets as untrusted input and validate them before dispatch
- Avoid shell metacharacter interpretation and apply platform-specific argument handling
- Require explicit user confirmation before opening external resources
- Run the editor and related tooling with least privilege and limit access to sensitive credentials
Mitigation generally focuses on preventing untrusted link data from reaching a command shell.
Common defensive patterns include:
- Prefer direct process-spawning APIs that pass arguments separately instead of shell-evaluated command strings
- Use a strict allowlist of supported URL schemes and reject unsupported or ambiguous targets
- Treat decoded Markdown link targets as untrusted input and validate them before dispatch
- Avoid shell metacharacter interpretation and apply platform-specific argument handling
- Require explicit user confirmation before opening external resources
- Run the editor and related tooling with least privilege and limit access to sensitive credentials
How teams detect issues like this
Organizations can look for:
- Static-analysis findings involving
child_process.exec, shell command construction, or concatenated user-controlled arguments - Code-review signals showing decoded URLs or Markdown content passed to operating-system helpers
- Tests covering shell metacharacters, unsupported schemes, encoded delimiters, and Windows-specific link behavior
- Policy checks requiring direct argument APIs and rejecting unnecessary shell invocation
- Endpoint telemetry showing unexpected child processes launched by the editor or its extensions
Organizations can look for:
- Static-analysis findings involving
child_process.exec, shell command construction, or concatenated user-controlled arguments - Code-review signals showing decoded URLs or Markdown content passed to operating-system helpers
- Tests covering shell metacharacters, unsupported schemes, encoded delimiters, and Windows-specific link behavior
- Policy checks requiring direct argument APIs and rejecting unnecessary shell invocation
- Endpoint telemetry showing unexpected child processes launched by the editor or its extensions
