PT-2026-47025 · Shd101Wyy · Markdown Preview Enhanced

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-50733

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-50733

Affected Products

Markdown Preview Enhanced

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-50733 · Security Note
• https://vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-wavedrom-eval · Note
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28 · Note
• https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315 · Note