CVE-2026-49493 Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-49493?
CVE-2026-49493 is a high-severity vulnerability in shd101wyy Markdown Preview Enhanced, published on 5 Jun 2026.
Official description
Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.
Weakness: CWE-94
Which versions are affected by CVE-2026-49493?
How do I fix CVE-2026-49493?
No fix has been published for CVE-2026-49493 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-49493 being exploited?
There is no known exploitation of CVE-2026-49493 in the wild and no public exploit code.
Sources
Also known as GHSA-m5v2-jw65-jh59.