« Volver al listado

CVE-2026-54566

Estado: RecibidaAlta (8.5)—

Markdown Preview Enhanced es una extensión de vista previa de Markdown para Visual Studio Code. Antes de la versión 0.8.29, Markdown Preview Enhanced evalúa los archivos .crossnote/config.js y .crossnote/parser.js controlados por el repositorio con vm.runInNewContext, lo que no proporciona un límite de seguridad frente al dominio (realm) del host de Node.js.

Leer descripción completaMostrar menos

Al abrir un archivo Markdown en un repositorio malicioso, estos archivos se cargan automáticamente, y el recorrido de la cadena de prototipos puede alcanzar el constructor Function del host y el objeto process, lo que permite ejecutar comandos del sistema operativo con la cuenta de la víctima sin necesidad de ninguna interacción adicional. Tanto la evaluación de la configuración como la evaluación de los hooks del analizador se ven afectadas, y el ataque no depende de que require con ámbito de módulo esté disponible. Este problema está corregido en la versión 0.8.29.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Markdown Preview Enhanced — Markdown Preview EnhancedAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-54566",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54566",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T19:44:50.050593Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "shd101wyy",
          "product": "vscode-markdown-preview-enhanced",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.8.29"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-14T20:17:47.403",
  "references": [
    {
      "url": "https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/crossnote/pull/443",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.30",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29."
    }
  ],
  "lastModified": "2026-10-14T20:17:47.403",
  "sourceIdentifier": "security-advisories@github.com"
}