CVE-2026-11422

HighCVSS 7.1/10Last modified Jul 23, 2026

Description

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-95

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
shd101wyy	Markdown Preview Enhanced	< 0.8.27
shd101wyy	crossnote	< 0.9.28

References

Timeline

Published: Jun 5, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1142209.1NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers ca CVE-2026-1142217.4NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Bas CVE-2026-1142226.2NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN CVE-2026-1142235.5NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract CVE-2026-1142296.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 befor CVE-2026-114239.4A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filena CVE-2026-1142309.8When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows au CVE-2026-1142328.1A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permis CVE-2026-1142338.1Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who CVE-2026-1142356.5Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated use CVE-2026-1142363.3storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounde CVE-2026-114248.3A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365.