Key points
- CVE-2026-54566 affects Markdown Preview Enhanced versions prior to 0.8.29.
- The flaw allows execution of operating-system commands as the victim user.
- A fix is available in version 0.8.29 of the extension.
Markdown Preview Enhanced for Visual Studio Code contains a high-severity vulnerability, tracked as CVE-2026-54566, which affects versions earlier than 0.8.29. The issue allows attackers to execute arbitrary code on a developer's machine by exploiting how the extension processes specific configuration files within a repository.
What happened
The National Vulnerability Database records CVE-2026-54566 with a CVSS score of 8.5, classifying it as high severity. The flaw stems from the extension evaluating repository-controlled files named .crossnote/config.js and .crossnote/parser.js using vm.runInNewContext. This execution method fails to provide a sufficient security boundary between the script and the Node.js host environment.
When a user opens a Markdown file from a malicious repository, the extension automatically loads these configuration files. Attackers can leverage prototype-chain traversal techniques to access the host Function constructor and the process object. This access enables the execution of operating-system commands under the victim's account privileges without requiring any further interaction from the user.
Both the configuration evaluation and the parser-hook evaluation mechanisms are affected by this design flaw. The attack vector does not depend on module-scoped require being available, making it broadly applicable to any repository containing these specific files. The vendor has released version 0.8.29, which resolves this issue.
Why it matters
Developers using Visual Studio Code often open repositories from untrusted or public sources to review code or documentation. This automatic execution model means that simply opening a file can trigger the compromise. As AppSec Scoop reported on 2026-10-16, similar plugin flaws have allowed low-level users to execute code on servers, posing severe risks.
The ability to run commands as the victim account allows attackers to execute operating-system commands. Since the exploitation requires no user interaction beyond opening the file, the attack surface is significant for any team using this extension.
What happens next
- Update Markdown Preview Enhanced to version 0.8.29 or later immediately.
- Audit open repositories for the presence of .crossnote/config.js or .crossnote/parser.js files.
- Review extension permissions and disable automatic processing of untrusted repository files where possible.
- Monitor vendor channels for further updates regarding this CVE.
Patch priority
Teams should prioritise updating systems that interact with external or untrusted repositories first. Check whether developers routinely open code from public sources or third-party contributors. Roll out the update to these high-exposure environments before addressing isolated internal systems. Ensure backups of current configurations are created before applying changes. Test the updated extension in a non-production environment to verify compatibility with existing workflows. If immediate updating is not feasible, restrict access to repositories containing the specific configuration files mentioned in the advisory.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Markdown Preview Enhanced
- Verify the current version of Markdown Preview Enhanced across all development workstations.
- Upgrade to version 0.8.29 as soon as the vendor provides the update.
- Educate developers on the risks of opening untrusted repository files in their editors.
- Monitor for any additional advisories related to this extension or similar tools.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Markdown Preview Enhanced are affected?
Versions prior to 0.8.29 are affected by this vulnerability.
Is there a fix available for CVE-2026-54566?
Yes, the issue is fixed in version 0.8.29.
What is the CVSS score for this vulnerability?
The CVSS score is 8.5, which is rated as high severity.
