Vulnerability · Published Jun 5, 2026 · Assigned by VulnCheck

CVE-2026-50733Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

High 8.8

In plain English

A high-severity security flaw in Markdown Preview Enhanced from shd101wyy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Affected products (as reported)

Vendor	Product	Versions
shd101wyy	Markdown Preview Enhanced	0 – before 0.8.28

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Release 0.8.28 release-notes
Issue #2315 issue-tracking
VulnCheck Advisory: Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval() third-party-advisory