CVE-2026-11422: Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Markdown Preview Enhancedfrom your environment.Uninstall or disable the Markdown Preview Enhanced extension (and its crossnote engine) until an official fix is released.
- Configuration
Disable WaveDrom rendering or disable the crossnote engine's processing of wavedrom fenced code blocks so that wavedrom content is not passed to the extension's eval path.
Markdown Preview Enhanced (WaveDrom rendering) WaveDrom fenced code block rendering = disabled - Compensating control
Do not open untrusted or unknown Markdown documents in VS Code while this extension is installed; if you must inspect untrusted documents, do so in a sandboxed environment (isolated VM/container) or after removing the extension.
- Operational
Audit the filesystem for unexpected or unauthorized file writes that occurred after opening suspicious Markdown files; restore impacted files from known-good backups and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11422?
The severity of CVE-2026-11422 is classified as high with a CVSS score of 7.1.
How can I mitigate CVE-2026-11422?
To mitigate CVE-2026-11422, you should upgrade to the latest version of Markdown Preview Enhanced or disable the WaveDrom rendering feature.
What type of attack is associated with CVE-2026-11422?
CVE-2026-11422 allows for code injection attacks through the execution of arbitrary JavaScript via malicious content in Markdown documents.
Which software is affected by CVE-2026-11422?
CVE-2026-11422 affects Markdown Preview Enhanced version 0.8.x and the Crossnote engine version 0.9.28.
How does CVE-2026-11422 exploit Markdown documents?
CVE-2026-11422 exploits Markdown documents by allowing attackers to embed malicious JavaScript content within a wavedrom fenced code block.