High severity · published Jun 5, 2026
CVE-2026-50733
Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Markdown Preview Enhanced · shd101wyy
before 0.8.28 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50733
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50733
github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315
github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28
www.vulncheck.com
https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-wavedrom-eval
More from Markdown Preview Enhanced
8.8
CVE-2026-49493
Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()
8.8
CVE-2026-49492
Markdown Preview Enhanced OS Command Injection in External File and Link Opening
8.8
CVE-2025-65716
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file
7.1
CVE-2026-11422
Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering