Executive brief
Markdown Preview Enhanced, a popular extension for viewing formatted documents, contains a security flaw that allows attackers to execute commands on a user's computer. By tricking a user into previewing a specially crafted Markdown file, an attacker could gain full control over the victim's system, potentially leading to data theft or malware installation. This issue specifically affects users on Windows systems.
Technical details
Markdown Preview Enhanced prior to version 0.8.28 is vulnerable to OS command injection (CWE-78) on Windows systems. The vulnerability exists because the application opens external files and links from the preview through a system shell without properly validating untrusted inputs. Specifically, the diagram 'filename' attribute, imported file paths, and the 'latex_engine' code-chunk attribute are susceptible to command injection. An attacker can achieve remote code execution by convincing a user to open or preview a malicious markdown document. The fix in version 0.8.28 involves passing these inputs as literal arguments rather than through a shell and implementing stricter input validation.
Affected products
- shd101wyy Markdown Preview Enhanced < 0.8.28
Timeline
- 2026-06-05: disclosed
- 2026-06-05: patched: Fixed in version 0.8.28
- 2026-06-05: advisory