CVE-2026-49493High· 8.8▾ TwilightMarkdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.
markdown_preview_enhanced < 0.8.28Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49492High· 8.8Markdown Preview Enhanced OS Command Injection in External File and Link Opening
CVE-2026-50733High· 8.8Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
CVE-2026-54566High· 8.5Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54525High· 8.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54703Medium· 5.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54702High· 7.3Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code