CVE-2026-50733High· 8.8▾ MidnightPoC available

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score61/ 100 · Elevated

impact 48.4 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 5, 2026

Updated

Nov 8, 2026

CVSS

8.8

Vendor

shd101wyy

Product

Markdown Preview Enhanced

CWE

CWE-95

Depth score

61 · Elevated

EPSS

0.67% · p52

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-06-05

Exploitation: poc
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 156 days

Jun 5, 2026Published
Disclosed via CVEORG
Nov 8, 2026Record revised
Last analysed / modified upstream
Nov 8, 2026EPSS first tracked
0.7%

shd101wyy CWE-95 #cve.org #exploit-available

Affected

markdown_preview_enhanced < 0.8.28

Full technical detail▾

Overview

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Affected

markdown_preview_enhanced < 0.8.28

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available

← Back to feed

CVE-2026-50733High· 8.8▾ MidnightPoC available

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score61/ 100 · Elevated

impact 48.4 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 5, 2026

Updated

Nov 8, 2026

CVSS

8.8

Vendor

shd101wyy

Product

Markdown Preview Enhanced

CWE

CWE-95

Depth score

61 · Elevated

EPSS

0.67% · p52

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-06-05

Exploitation: poc
Automatable: no
Technical impact: total

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 156 days

Jun 5, 2026Published
Disclosed via CVEORG
Nov 8, 2026Record revised
Last analysed / modified upstream
Nov 8, 2026EPSS first tracked
0.7%

shd101wyy CWE-95 #cve.org #exploit-available

Affected

markdown_preview_enhanced < 0.8.28

Full technical detail▾

Overview

Affected

markdown_preview_enhanced < 0.8.28

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available