Description
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
shd101wyy vscode-markdown-preview-enhanced
< 0.8.29affected
References
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch ↗
- https://github.com/shd101wyy/crossnote/pull/443 ↗
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320 ↗
- https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640 ↗
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c ↗
- https://github.com/shd101wyy/crossnote/releases/tag/0.9.30 ↗
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29 ↗