CVE-2026-49492 | BDVDB-2026-338302 Detail

Description#

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-05Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.