Read the docs
TI-2026-09857 Aliases CVE-2026-11422GHSA-m48c-hxqg-4j76

Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering

Priority HIGH 72CWE-95Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-95.

Summary

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Fixed Markdown Preview Enhanced (shd101wyy): 0.8.27crossnote (shd101wyy): 0.9.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shd101wyyMarkdown Preview Enhancedbefore 0.8.270.8.27Patch availableCNA
shd101wyycrossnotebefore 0.9.280.9.28Patch availableCNA
  • Markdown Preview Enhanced Vendorshd101wyy Affected before 0.8.27 Fixed in 0.8.27 Patch available CNA
  • crossnote Vendorshd101wyy Affected before 0.9.28 Fixed in 0.9.28 Patch available CNA

Remediation

  • Fix · CNA Markdown Preview Enhanced (shd101wyy) Fixed in 0.8.27
  • Fix · CNA crossnote (shd101wyy) Fixed in 0.9.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11422
  2. 2026-10-03 Alias added: GHSA-m48c-hxqg-4j76

References

Patch 2

Other 1

  • TI-2025-40425 An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows… CVSS 3.1HIGH 8.8
  • TI-2026-74453 Sandbox escape in Markdown Preview Enhanced allows code execution CVSS 4.0HIGH 8.5
  • TI-2026-37396 Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval() CVSS 4.0HIGH 8.6
  • TI-2026-74455 Unvalidated command dispatch in Markdown Preview Enhanced extension CVSS 4.0HIGH 7.3
  • TI-2026-74454 Cross-site scripting in Markdown Preview Enhanced VS Code extension CVSS 4.0MEDIUM 6.9
  • TI-2026-74456 Arbitrary file write in Markdown Preview Enhanced for VS Code CVSS 4.0MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences