CVE-2026-49492High· 8.8▾ MidnightPoC availableMarkdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and th…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
1 GitHub repo (last check)
Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.
markdown_preview_enhanced < 0.8.28Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50733High· 8.8Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
CVE-2026-49493High· 8.8Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()
CVE-2026-54525High· 8.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54703Medium· 5.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54702High· 7.3Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54701Medium· 6.9Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code