Markdown Preview Enhanced before version 0.8.28 improperly controls code generation when parsing Bitfield fenced code blocks. It uses interpretJS() that executes the block content as JavaScript code in a new VM context, enabling an attacker to execute arbitrary code on the server when rendering or exporting a crafted markdown document containing a malicious bitfield code block. The vulnerability is addressed in version 0.8.28 by switching to JSON5.parse() for parsing bitfield register definitions, eliminating code execution and restricting parsing to data only.

An attacker can achieve arbitrary code execution on the server by supplying a malicious markdown document with a crafted bitfield code block. This can lead to full compromise of the server environment where the markdown is rendered or exported. The vulnerability has a high CVSS 4.0 score of 8.6, indicating significant impact with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

Upgrade Markdown Preview Enhanced to version 0.8.28 or later, where the vulnerability is fixed by replacing the unsafe code evaluation with safe JSON5 parsing. No other mitigations are indicated or recommended by the vendor advisory. Patch status is not explicitly stated but the fix is included in version 0.8.28.