Code Injection Vulnerability in Markdown Preview Enhanced by shd101wyy

CVE-2026-11422

What is CVE-2026-11422?

The Markdown Preview Enhanced extension versions 0.8.x, which employs the Crossnote engine version 0.9.28, is susceptible to a code injection vulnerability. This occurs within the WaveDrom rendering pipeline, allowing attackers to execute arbitrary JavaScript. By inserting specially crafted content into a wavedrom fenced code block within a Markdown document, malicious actors can exploit unsanitized data passed to window.eval() in the VS Code webview. This manipulation enables them to abuse the extension's messaging capabilities, potentially leading to unauthorized file writes on the local filesystem.

References