CVE-2026-54566

Awaiting Analysis Awaiting Analysis - Queue

Prototype Pollution in Markdown Preview Enhanced

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54566

EUVD

EUVD-2026-101582

Affected Vendors & Products

Vendor	Product	Version / Range
shd101wyy	vscode-markdown-preview-enhanced	< 0.8.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a remote code execution flaw in the Markdown Preview Enhanced VSCode extension. It occurs when the extension evaluates .crossnote/config.js and .crossnote/parser.js files from untrusted repositories using insecure methods like vm.runInNewContext. Attackers can exploit prototype-chain traversal to access the host's Function constructor and process object, allowing arbitrary OS commands to run without user interaction.

Detection Guidance

Check if the vulnerable extension version (v0.8.28 or earlier) is installed by running: code --list-extensions | grep markdown-preview-enhanced. Inspect repositories for malicious .crossnote/config.js or .crossnote/parser.js files that may contain prototype pollution or command execution payloads.

Impact Analysis

If you open a malicious markdown file in a repository with the vulnerable extension (versions up to 0.8.28), an attacker can execute commands on your system under your user account. This could lead to data theft, malware installation, or system compromise without requiring further actions from you.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of protected health information). Organizations using the vulnerable extension may face compliance breaches if exploited.

Mitigation Strategies

Update the Markdown Preview Enhanced extension to version 0.8.29 or later. Remove any .crossnote/config.js or .crossnote/parser.js files from untrusted repositories. Disable the extension if an update is unavailable.

Hi! I’m here to help you understand CVE-2026-54566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70