CVE-2026-49492: Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Synopsis

OS command injection in Markdown Preview Enhanced (versions before 0.8.28) allows a crafted markdown document to execute arbitrary operating system commands on Windows when the document is previewed. The vulnerability is reachable over the network in the sense that a victim can receive or download a malicious markdown file, and no authentication is required from the attacker's side. Successful exploitation gives the attacker full read access, write access, and the ability to crash or disrupt the host process running the preview. A patched-image rebuild at version 0.8.28 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted markdown document to the victim over the network, such as via a hosted file, email attachment, or shared repository.

• AuthenticationNot required

  No account or credentials on the target system are required; the attacker only needs the victim to open a malicious document.

• Victim interactionRequired

  The victim must actively open or preview the crafted markdown document, making this a social-engineering vector that requires user action to trigger.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim previews the document; no race conditions or special memory layout are needed.

Blast Radius

• Attacker executes arbitrary OS commands in the context of the user running the markdown preview, gaining full read access to files and secrets accessible by that user.
• Attacker can write, modify, or delete files on the host, including configuration files, credentials, and source code.
• Attacker can crash or disrupt the preview process and any dependent services running under the same user context.