CVE-2026-49493

The flaw

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a m

What to do

Review advisory and patch per vendor guidance.

References