CVE-2026-11422
High
Description
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.
SeverityHigh
CVSS7.1
Exploit probability—
ProductMarkdown Preview Enhanced
PublishedJun 5, 2026
First seenJun 5, 2026
Weakness typeCWE-95CWE-95
How to fix
Update
- shd101wyy Markdown Preview Enhanced0.8.27 or later
- shd101wyy crossnote0.9.28 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shd101wyy Markdown Preview Enhanced | v < 0.8.27 | 0.8.27 |
| shd101wyy crossnote | v < 0.9.28 | 0.9.28 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.