Arbitrary Code Execution in Markdown Preview Enhanced by shd101wyy

CVE-2026-50733

What is CVE-2026-50733?

Markdown Preview Enhanced prior to version 0.8.28 has a significant security flaw that permits arbitrary JavaScript code execution through the parsing of untrusted markdown content, specifically when evaluating WaveDrom diagrams. The vulnerability can be exploited in various render paths, including live preview and HTML export functionalities. Attackers can leverage this flaw by inserting a crafted markdown document, which allows them to execute arbitrary code and potentially perform unauthorized file writes. The issue has been mitigated in version 0.8.28 by implementing JSON5.parse() for parsing and sanitizing WaveDrom data scripts to comply with strict JSON, thus preventing such exploits.

References