CVE-2026-54566: Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Markdown Preview Enhancedto a version that resolves this vulnerability.Fixed in 0.8.29
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Markdown Preview Enhanced versions prior to 0.8.29 are exposed when they open a Markdown file from a malicious repository containing .crossnote/config.js or .crossnote/parser.js.
What interaction is required for exploitation?
An attacker needs to get the victim to open a Markdown file in a repository they control. The repository-controlled Crossnote files are loaded automatically, and no further victim interaction is required.
What can an attacker do if exploitation succeeds?
The attacker can escape the VM context through prototype-chain traversal, reach the host Node.js process, and execute operating-system commands as the victim account.
Are both Crossnote configuration and parser hooks affected?
Yes. Evaluation of both .crossnote/config.js and .crossnote/parser.js is affected, and exploitation does not require module-scoped require to be available.
What version fixes the issue?
Upgrade Markdown Preview Enhanced to version 0.8.29 or later.