CVE-2026-50733 Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
Attackers can execute arbitrary code and write files by tricking users into previewing crafted Markdown with WaveDrom diagrams in Markdown Preview Enhanced.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50733?
CVE-2026-50733 is a high-severity code injection vulnerability in shd101wyy Markdown Preview Enhanced, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.
Weakness: CWE-95
Which versions are affected by CVE-2026-50733?
How do I fix CVE-2026-50733?
No fix has been published for CVE-2026-50733 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-50733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50733 exists.
Sources
Also known as GHSA-j39p-jf99-v5w8.