CVE-2026-54566

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-10-14 20:17

Modified: 2026-10-16 16:00

NVD status: Awaiting Analysis

Last synced 1 day ago

Verified against the source API 2026-10-27 07:02 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-94

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640 security-advisories@github.com
https://github.com/shd101wyy/crossnote/pull/443 security-advisories@github.com
https://github.com/shd101wyy/crossnote/releases/tag/0.9.30 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6d... security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427... security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427... 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:02 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores