CVE-2026-50733 Details
Description
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.
A code injection vulnerability has been identified in Markdown Preview Enhanced versions prior to 0.8.28. This issue arises from the extension's WaveDrom diagram rendering process, which evaluates untrusted markdown content using 'eval()'. As a result, arbitrary JavaScript execution is possible. The vulnerability can be exploited in the live preview, presentation mode, and during HTML export. Additionally, it can be triggered by injecting a '<script type="WaveDrom">' element through raw HTML in markdown. When a victim previews or exports a manipulated markdown file, the attacker can execute arbitrary code, leading to unauthorized file writes.
Users can update to Markdown Preview Enhanced version 0.8.28 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-wavedrom-eval | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Markdown Preview Enhanced | >= 0, < 0.8.28 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |