OS Command Injection Vulnerability in Markdown Preview Enhanced by shd101wyy

CVE-2026-49492

What is CVE-2026-49492?

The Markdown Preview Enhanced extension prior to version 0.8.28 allows external files and links to be opened via a shell without proper validation of untrusted inputs from the markdown document. This flaw, particularly on Windows systems, enables an attacker to craft a markdown file that could execute arbitrary operating system commands when previewed. The vulnerability has been addressed in version 0.8.28 by ensuring that these inputs are treated as literal arguments, alongside rigorous validation to mitigate risks.

References