CVE-2026-49493: Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

Synopsis

An arbitrary code execution vulnerability exists in Markdown Preview Enhanced, a server-side markdown rendering extension, before version 0.8.28. The flaw is reached over the network and requires no authentication, but a victim must open or render a crafted markdown document. Successful exploitation gives an attacker full control over the rendering process, enabling arbitrary code execution on the server. A patched-image rebuild at version 0.8.28 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious markdown document over the network, so the vulnerable rendering service must be reachable or the document must be transmitted to a victim via a network channel.

• AuthenticationNot required

  No credentials or account privileges are needed; any unauthenticated party can craft and deliver a malicious document.

• Victim interactionRequired

  A victim must open or trigger rendering of the crafted markdown document, making this a social-engineering vector where the attacker must convince someone to process the file.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory layout dependencies, or special environmental configuration are required beyond delivering the document.

Blast Radius

• The attacker executes arbitrary code in the server-side rendering process, gaining the same system access as the process owner.
• Confidential data accessible to the rendering process, including environment variables, credentials, and files, is read directly.
• The attacker can write or overwrite files and data reachable by the rendering process, tampering with application state or stored content.
• The rendering service itself can be crashed or its process hijacked, causing a denial of service for any user depending on document rendering or export.