Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54566— Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

Quick assessment

Affected
shd101wyy vscode-markdown-preview-enhanced
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Markdown Preview Enhanced 是 Visual Studio Code 的一个 Markdown 预览扩展。在 0.8.29 版本之前，该扩展会使用 执行由仓库控制的 和 文件，而这种方式并未在 Node.js 宿主环境之间提供安全边界。当用户在恶意仓库中打开一个 Markdown 文件时，会自动加载这些文件，通过原型链遍历可以访问宿主的 构造函数和 对象，从而无需用户进一步交互即可以受害者账户的身份执行操作系统命令。无论是配置文件的评估还是解析器钩子的评估均受到该漏洞影响，并且该攻击不依赖于

CVSS 8.5 · High EPSS 0.30% · P21

Affected Version Matrix 1

VendorProduct Version RangeStatus
shd101wyy vscode-markdown-preview-enhanced < 0.8.29 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54566

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
Source: CVE Program / CVE List V5
Vulnerability Description
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shd101wyy vscode-markdown-preview-enhanced < 0.8.29 -

II. Public POCs for CVE-2026-54566

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54566

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54566 (3)

Other References for CVE-2026-54566 (3)

Same Patch Batch · shd101wyy · 2026-10-14 · 5 CVEs total

CVE-2026-54525 8.8 HIGH Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
CVE-2026-54702 7.3 HIGH Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
CVE-2026-54701 6.9 MEDIUM Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in
CVE-2026-54703 5.8 MEDIUM Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Va

IV. Related Vulnerabilities

Same product: vscode-markdown-preview-enhanced
Same vendor: shd101wyy
Same weakness: CWE-94

V. Comments for CVE-2026-54566

No comments yet

Leave a comment