CVE-2026-50733: Markdown Preview Enhanced RCE Flaw

CVE-2026-50733 Overview

CVE-2026-50733 is an arbitrary code execution vulnerability in Markdown Preview Enhanced versions prior to 0.8.28. The extension parses WaveDrom diagrams by passing untrusted markdown content to eval(), enabling JavaScript execution during preview and export operations. The flaw affects every render path, including the live preview through window.eval, presentation mode, and HTML export through the bundled WaveDrom.ProcessAll() and eva() helpers. Attackers can also reach the sink through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim opens or exports a crafted document, the attacker gains code execution leading to arbitrary file write. The issue is tracked under [CWE-95].

Critical Impact
Opening or exporting a crafted markdown file in a vulnerable version of Markdown Preview Enhanced executes attacker-controlled JavaScript, resulting in arbitrary code execution and file write on the victim host.

Affected Products

Markdown Preview Enhanced (VS Code extension) before 0.8.28
Markdown Preview Enhanced render pipelines: live preview, presentation mode, and HTML export
WaveDrom diagram parsing via WaveDrom.ProcessAll() / eva() helpers and <script type="WaveDrom"> blocks

Discovery Timeline

2026-06-05 - CVE-2026-50733 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-50733

Vulnerability Analysis

Markdown Preview Enhanced renders WaveDrom timing diagrams embedded in markdown documents. To convert the diagram source into a JavaScript object, the extension passes the content of WaveDrom blocks directly to eval(). Because WaveDrom blocks accept arbitrary text from the markdown document, any JavaScript supplied inside the block runs in the same context as the preview renderer.

The sink is reachable through multiple render paths. The live preview invokes window.eval on the block contents. Presentation mode and HTML export use the bundled WaveDrom.ProcessAll() and eva() helpers, which internally call eval() on the same untrusted input. A third path exists when an attacker injects raw HTML containing <script type="WaveDrom"> directly into the markdown, bypassing the fenced-block parser entirely.

The impact is arbitrary code execution in the renderer process and arbitrary file write on the host. Documented consequences include modification of files accessible to the user running the editor.

Root Cause

The root cause is unsafe code evaluation [CWE-95]: untrusted document content reaches a JavaScript eval() sink without sanitization or parser substitution. WaveDrom syntax resembles JSON5, but the original parser chose eval() to support JavaScript-style object literals, conflating data parsing with code execution.

Attack Vector

An attacker delivers a crafted markdown file through email, repository clone, shared documentation, or any channel that ends with the victim previewing the file in VS Code. The malicious file contains a WaveDrom fenced block, a WaveDrom helper invocation, or a raw <script type="WaveDrom"> element whose body is JavaScript rather than diagram data. When the victim opens the preview or runs an HTML export, the embedded JavaScript executes with the privileges of the editor process. User interaction is required, but no authentication and no special privileges are needed.

No verified public proof-of-concept code is referenced in the advisory. See the VulnCheck Arbitrary Code Execution Advisory and GitHub Issue #2315 for technical details.

Detection Methods for CVE-2026-50733

Indicators of Compromise

Markdown files containing WaveDrom fenced code blocks whose contents include JavaScript constructs such as require(, process., child_process, or fs.writeFile rather than diagram fields.
Presence of raw <script type="WaveDrom"> elements inside markdown documents pulled from untrusted sources.
Unexpected child processes or file writes initiated by the VS Code renderer or Electron host shortly after a markdown preview is opened.

Detection Strategies

Scan repositories and document stores for markdown files containing the strings ```wavedrom or <script type="WaveDrom"> and inspect the block bodies for non-JSON content.
Inventory installed VS Code extensions across endpoints and flag shd101wyy.markdown-preview-enhanced at versions below 0.8.28.
Hunt for process telemetry showing the VS Code helper process spawning shells, node, powershell.exe, or performing writes outside the workspace immediately after a .md file is opened.

Monitoring Recommendations

Alert on EDR telemetry where the VS Code renderer process is the parent of command interpreters or scripting hosts.
Monitor file integrity for sensitive user-profile paths (SSH keys, shell rc files, startup folders) modified by editor processes.
Track extension install and update events to ensure deployed versions of Markdown Preview Enhanced are at or above the fixed release.

How to Mitigate CVE-2026-50733

Immediate Actions Required

Upgrade Markdown Preview Enhanced to version 0.8.28 or later across all developer endpoints.
Until patched, avoid previewing or exporting markdown files from untrusted sources, including cloned repositories, email attachments, and external documentation.
Audit shared documentation repositories for WaveDrom blocks and <script type="WaveDrom"> elements containing JavaScript payloads.

Patch Information

The fix is shipped in GitHub Release v0.8.28. The patch replaces eval() with JSON5.parse() for WaveDrom block parsing and sanitizes inline WaveDrom data scripts into inert strict JSON before any rendering step. This removes the code execution sink from the live preview, presentation mode, and HTML export paths.

Workarounds

Disable or uninstall the Markdown Preview Enhanced extension on endpoints that cannot be updated immediately.
Use the built-in VS Code markdown preview, which does not invoke WaveDrom parsing, when reviewing untrusted documents.
Restrict markdown rendering to a sandboxed or container-based development environment so any executed code is isolated from the host file system.

bash

# Verify and update the extension version from the VS Code CLI
code --list-extensions --show-versions | grep markdown-preview-enhanced
code --install-extension shd101wyy.markdown-preview-enhanced@0.8.28 --force