Two issues in the static-eval node module that can lead to remote code execution.

Previewing a malicious Markdown file in VS Code 1.9.1 can lead to arbitrary code execution.