Vulnerability · Published Jun 5, 2026 · Assigned by VulnCheck
CVE-2026-49492Markdown Preview Enhanced OS Command Injection in External File and Link Opening
High 8.8
In plain English
A high-severity OS command injection in Markdown Preview Enhanced from shd101wyy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| shd101wyy | Markdown Preview Enhanced | 0 – before 0.8.28 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- Release 0.8.28 release-notes
- VulnCheck Advisory: Markdown Preview Enhanced OS Command Injection in External File and Link Opening third-party-advisory