CVE-2026-54566 Code injection in vscode-markdown-preview-enhanced
Attackers can execute arbitrary OS commands by tricking users into opening a malicious repository, exploiting unsafe JavaScript evaluation in the Markdown Preview Enhanced extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-54566?
CVE-2026-54566 is a high-severity code injection vulnerability in shd101wyy vscode-markdown-preview-enhanced, published on 14 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
Weakness: CWE-94
Which versions are affected by CVE-2026-54566?
How do I fix CVE-2026-54566?
No fix has been published for CVE-2026-54566 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-54566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54566 exists.
Sources
Also known as GHSA-427h-jhpr-8jch.