Read the docs

shd101wyy

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

shd101wyy records in CISA KEV

No shd101wyy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Markdown Preview Enhanced 1 record HIGH

Records

10 records

TI-2026-37396 CVE-2026-50733 · GHSA-j39p-jf99-v5w8

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Priority HIGH 72

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00667 Published 2026-06-05 Fixed in 0.8.28 CWE-95
TI-2026-09857 CVE-2026-11422 · GHSA-m48c-hxqg-4j76

Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering

Priority HIGH 72

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00159 Published 2026-06-05 Fixed in 0.8.27, 0.9.28 CWE-95
TI-2026-36643 CVE-2026-49493 · GHSA-m5v2-jw65-jh59

Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

Priority LOW 39

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00327 Published 2026-06-05 Fixed in 0.8.28 CWE-94
TI-2026-36642 CVE-2026-49492 · GHSA-3vxg-8vgp-994w

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Priority LOW 39

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported f…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0034 Published 2026-06-05 Fixed in 0.8.28 CWE-78
Open these records in search →