CVE-2026-50733

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions prior to 0.8.28

Description The software parses WaveDrom diagrams by evaluating untrusted markdown content using the eval() function, which allows for arbitrary JavaScript execution. This issue affects all render paths, including the live preview via window.eval, presentation mode, and HTML export through the WaveDrom.ProcessAll() and eva() helpers. Additionally, the flaw can be triggered by injecting a <script type="WaveDrom"> element via raw HTML in markdown. An attacker can execute arbitrary code and perform arbitrary file writes when a victim previews or exports a specially crafted markdown document.

Recommendations Update to version 0.8.28.