Junglewise Threat Intelligence

CVE-2026-11422: Markdown Preview Enhanced code injection in WaveDrom rendering

CVE-2026-11422 · Severity: high · CVSS 7.1 · Published 2026-06-05

Technologies: Shd101wyy Markdown Preview Enhanced. Vendors: Shd101wyy.

Executive brief

Markdown Preview Enhanced is a popular extension for VS Code used to render complex diagrams and documents. A security flaw in its diagram rendering engine allows a malicious Markdown file to execute unauthorized code on a user's computer when the file is previewed. This could allow an attacker to silently modify or steal sensitive local files, such as SSH keys, potentially leading to full system compromise.

Technical details

A code injection vulnerability exists in the WaveDrom rendering pipeline of Markdown Preview Enhanced due to the use of `window.eval()` on unsanitized content from fenced code blocks. While the extension employs Cheerio and DOMPurify for sanitization, it explicitly allowlists WaveDrom script tags, permitting malicious payloads to reach the rendering stage. An attacker can exploit this by crafting a Markdown document that, when previewed, executes JavaScript in the VS Code webview context. This execution can be leveraged to abuse the extension's message-passing IPC to invoke the `updateMarkdown` command, which performs arbitrary file writes via `vscode.workspace.fs.writeFile` without path validation. The issue is addressed in crossnote 0.9.29 and Markdown Preview Enhanced 0.8.28 by replacing `eval()` with `JSON5.parse()` and implementing stricter HTML sanitization.

Affected products

  • shd101wyy Markdown Preview Enhanced 0.8.x
  • shd101wyy crossnote engine 0.9.28

Timeline

  • 2026-06-02: disclosed: Issue reported via GitHub repository
  • 2026-06-05: patched: Fixes released in crossnote 0.9.29 and MPE 0.8.28
  • 2026-06-05: advisory: CVE-2026-11422 published

References

Related threats