{"metadata": {"vulnerability": "CVE-2026-54566", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-06-15T19:15:27.342Z", "date_only": false, "value": "2026-06-15T19:15:27.342Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54566", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T19:08:43.663Z", "date_only": false, "value": "2026-10-14T19:08:43.663Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54566", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T19:08:43.663Z", "date_only": false, "value": "2026-10-14T19:08:43.663Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-54566", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:44:50.050Z", "date_only": false, "value": "2026-10-14T19:44:50.050593Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54566", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:44:50.050Z", "date_only": false, "value": "2026-10-14T19:44:50.050593Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54566", "record": "FKIE_CVE-2026-54566", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T19:45:22.736Z", "date_only": false, "value": "2026-10-14T19:45:22.736Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54566", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:45:22.736Z", "date_only": false, "value": "2026-10-14T19:45:22.736Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54566", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T20:17:47.403Z", "date_only": false, "value": "2026-10-14T20:17:47.403", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54566", "record": "FKIE_CVE-2026-54566", "field": "published"}, {"timestamp": "2026-10-15T00:07:26.091Z", "date_only": false, "value": "2026-10-15T00:07:26.091747Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117442009199617403", "record": "CVE-2026-54566", "field": "creation_timestamp", "uuid": "84e646bf-db5b-44d1-9982-babce7c2dfa5", "content": "CVE-2026-54566 Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js` Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54566https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jchhttps://github.com/shd101wyy/crossnote/pull/443https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4chttps://github.com/shd101wyy/crossnote/releases/tag/0.9.30https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29#shd101wyy #vscode-markdown-preview-enhanced#CVE_2026_54566#bot", "url": "https://infosec.exchange/users/cve/statuses/117442009199617403"}, {"timestamp": "2026-10-16T16:00:33.533Z", "date_only": false, "value": "2026-10-16T16:00:33.533", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54566", "record": "FKIE_CVE-2026-54566", "field": "lastModified"}]}