CVE-2026-49493 – Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

CVE ID :CVE-2026-49493

Published : June 5, 2026, 6:17 p.m. | 15 minutes ago

Description :Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…