Code Execution Vulnerability in Markdown Preview Enhanced by shd101wyy

CVE-2026-54566

What is CVE-2026-54566?

Markdown Preview Enhanced is a widely-used Markdown preview extension for Visual Studio Code, which prior to version 0.8.29, included a security flaw. The extension was capable of evaluating configuration and parser files from malicious repositories without adequate security isolation from Node.js's host realm. This vulnerable behavior allowed the execution of OS commands through prototype-chain traversal, exposing users to significant risk simply by opening a Markdown file from an untrusted source. The flaw can execute commands under the victim's account without any further user interaction, formally necessitating an update to version 0.8.29 or later for protection against this exploit.

References