Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: shd101wyy Markdown Preview Enhanced 0.8.28 Clear all filters
TI-2026-37396 CVE-2026-50733 · GHSA-j39p-jf99-v5w8

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Priority HIGH 72

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00667 Published 2026-06-05 Fixed in 0.8.28 CWE-95
TI-2026-36643 CVE-2026-49493 · GHSA-m5v2-jw65-jh59

Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

Priority LOW 39

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00327 Published 2026-06-05 Fixed in 0.8.28 CWE-94
TI-2026-36642 CVE-2026-49492 · GHSA-3vxg-8vgp-994w

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Priority LOW 39

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported f…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0034 Published 2026-06-05 Fixed in 0.8.28 CWE-78