Markdown Preview Enhanced prior to version 0.8.28 improperly controls code generation by evaluating Bitfield fenced code blocks as executable code using interpretJS() and vm.runInNewContext(). This allows an attacker to craft a markdown document containing malicious bitfield code blocks that execute arbitrary code on the server side during rendering or export. The vulnerability is resolved in version 0.8.28 by switching to JSON5.parse() for parsing bitfield register definitions, eliminating code execution risk.

Successful exploitation allows an attacker to execute arbitrary code on the server processing the markdown document, potentially leading to full system compromise or unauthorized actions. The vulnerability requires no privileges and no user interaction other than rendering or exporting the crafted markdown. The high CVSS score (8.6) reflects the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Upgrade to Markdown Preview Enhanced version 0.8.28 or later, where the vulnerability is fixed by replacing code evaluation with safe JSON5 parsing. Since this is a client-side application, users should ensure they do not render or export untrusted markdown documents with vulnerable versions. Patch status is not explicitly confirmed in the vendor advisory, but the fix is documented in version 0.8.28 release notes. Check the vendor's official channels for the latest updates and apply the official fix.