Shd101wyy vulnerabilities
We track 8 vulnerabilities in Shd101wyy products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Shd101wyy vulnerabilities
- 7.3 High severity
vscode-markdown-preview-enhanced: Exposed Dangerous Method or Function
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _cr
- 8.5 High severity
vscode-markdown-preview-enhanced: Improper Control of Generation of Code
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a s
- 8.8 High severity
vscode-markdown-preview-enhanced: Improper Neutralization of Special Elements used in an OS Command
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exe
- 7.1 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within
- 8.8 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML
- 8.8 High severity
Markdown Preview Enhanced: Improper Control of Generation of Code
Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield co
- 8.8 High severity
Markdown Preview Enhanced: Improper Neutralization of Special Elements used in an OS Command
Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chu
- 8.8 High severity
Markdown Preview Enhanced: Improper Control of Generation of Code
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.