CVE-2026-54566

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

• CWE-94

• https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640
• https://github.com/shd101wyy/crossnote/pull/443
• https://github.com/shd101wyy/crossnote/releases/tag/0.9.30
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch

Published

Oct 14, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5456A vulnerability was identified in Align Technology My Invisa…3.3
• CVE-2026-54560Cloudreve is a self-hosted file management and sharing syste…7.6
• CVE-2026-54561MCP Memory Keeper is an MCP server for persistent context ma…6.2
• CVE-2026-54562Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-54563Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-54565rhwp is an HWP viewer and editor implemented in Rust and Web…4.7
• CVE-2026-54567Flask-Reuploaded provides file uploads for Flask. From 1.5.0…7.5
• CVE-2026-54568Microsoft UFO open-source framework for intelligent automati…4.3
• CVE-2026-54569SENAITE.CORE is the core framework for the SENAITE laborator…9.8
• CVE-2026-5457A security flaw has been discovered in PropertyGuru AgentNet…3.3
• CVE-2026-54570AngleSharp is a .NET library for parsing angle bracket based…6.9
• CVE-2026-54571ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…8.7