Markdown Preview Enhanced vulnerabilities
5 known vulnerabilities in Markdown Preview Enhanced from Shd101wyy. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within
- 8.8 High severity
Markdown Preview Enhanced: Improper Neutralization of Directives in Dynamically Evaluated Code
Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML
- 8.8 High severity
Markdown Preview Enhanced: Improper Control of Generation of Code
Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield co
- 8.8 High severity
Markdown Preview Enhanced: Improper Neutralization of Special Elements used in an OS Command
Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chu
- 8.8 High severity
Markdown Preview Enhanced: Improper Control of Generation of Code
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.