Arbitrary Code Execution Vulnerability in Markdown Preview Enhanced by shd101wyy
CVE-2026-49493

8.6HIGH

Key Information:

Vendor

Shd101wyy

Status
Markdown Preview Enhanced
Vendor
CVE Published:
5 June 2026

What is CVE-2026-49493?

The Markdown Preview Enhanced extension, up until version 0.8.28, contains a vulnerability that allows for arbitrary code execution through the use of improperly handled bitfield fenced code blocks. Utilizing the interpretJS() function, the extension evaluates content as executable code, which could lead to the execution of malicious commands on the server when a specially crafted markdown document is processed. This vulnerability has been addressed in version 0.8.28 by implementing a safer parsing mechanism using JSON5.parse(), ensuring that bitfield register definitions are treated as data and not executable code.

Affected Version(s)

Markdown Preview Enhanced 0 < 0.8.28

References

https://github.com/shd101wyy/vscode-markdown-preview-enha...
release-notes
https://www.vulncheck.com/advisories/markdown-preview-enh...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.