Is CVE-2026-11422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11422 being exploited in the wild.

How severe is CVE-2026-11422?

High severity, with a CVSS score of 7.1, published 5 June 2026.

Which products and versions are affected?

Shd101wyy Crossnote Engine 0.9.28; Shd101wyy Markdown Preview Enhanced 0.8.x.

Is there a fix for CVE-2026-11422?

A patch was published on 2026-06-05: Fixes released in crossnote 0.9.29 and MPE 0.8.28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11422 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-11422?

Check whether you run Shd101wyy Crossnote Engine or Shd101wyy Markdown Preview Enhanced at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11422: Markdown Preview Enhanced code injection in WaveDrom rendering

CVE-2026-11422 · Severity: high · CVSS 7.1 · Published 2026-06-05

Markdown Preview Enhanced is a popular extension for VS Code used to render complex diagrams and documents. A security flaw in its diagram rendering engine allows a malicious Markdown file to execute unauthorized code on a user's computer when the file is previewed. This could allow an attacker to silently modify or steal sensitive local files, such as SSH keys, potentially leading to full system compromise.

Technologies: Shd101wyy Markdown Preview Enhanced. Vendors: Shd101wyy.

Quick answers

Is CVE-2026-11422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11422 being exploited in the wild.
How severe is CVE-2026-11422?: High severity, with a CVSS score of 7.1, published 5 June 2026.
Which products and versions are affected?: Shd101wyy Crossnote Engine 0.9.28; Shd101wyy Markdown Preview Enhanced 0.8.x.
Is there a fix for CVE-2026-11422?: A patch was published on 2026-06-05: Fixes released in crossnote 0.9.29 and MPE 0.8.28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11422 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-11422?: Check whether you run Shd101wyy Crossnote Engine or Shd101wyy Markdown Preview Enhanced at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in the WaveDrom rendering pipeline of Markdown Preview Enhanced due to the use of `window.eval()` on unsanitized content from fenced code blocks. While the extension employs Cheerio and DOMPurify for sanitization, it explicitly allowlists WaveDrom script tags, permitting malicious payloads to reach the rendering stage. An attacker can exploit this by crafting a Markdown document that, when previewed, executes JavaScript in the VS Code webview context. This execution can be leveraged to abuse the extension's message-passing IPC to invoke the `updateMarkdown` command, which performs arbitrary file writes via `vscode.workspace.fs.writeFile` without path validation. The issue is addressed in crossnote 0.9.29 and Markdown Preview Enhanced 0.8.28 by replacing `eval()` with `JSON5.parse()` and implementing stricter HTML sanitization.

Affected products

shd101wyy Markdown Preview Enhanced 0.8.x
shd101wyy crossnote engine 0.9.28

Timeline

2026-06-02: disclosed: Issue reported via GitHub repository
2026-06-05: patched: Fixes released in crossnote 0.9.29 and MPE 0.8.28
2026-06-05: advisory: CVE-2026-11422 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.