CVE-2026-50733: Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Synopsis

Arbitrary code execution via unsafe eval() in Markdown Preview Enhanced affects versions before 0.8.28. The vulnerability is reached over the network with no authentication required, but a victim must open and preview or export a crafted markdown document. Successful exploitation gives an attacker full arbitrary JavaScript execution in the victim's environment, enabling arbitrary file writes on the victim's machine. A patched-image rebuild at version 0.8.28 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted markdown document over the network, so the victim's environment must be reachable or the victim must fetch the malicious file from a network-accessible source.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated party can craft and deliver a malicious markdown file.

• Victim interactionRequired

  The victim must open and preview or export the crafted markdown document, making this a social-engineering vector that requires the victim to take an explicit action.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the document; no race conditions, memory layout dependencies, or environmental factors need to be satisfied.

Blast Radius

• Attacker executes arbitrary JavaScript in the victim's Markdown Preview Enhanced render context with the privileges of the process running the editor.
• Arbitrary file writes are enabled on the victim's local filesystem, allowing the attacker to plant malicious files, overwrite configuration, or exfiltrate data by writing to a network-accessible path.
• All confidential content visible to the editor process, including locally stored documents, credentials files, and environment variables, is exposed to the attacker's injected code.
• Integrity of the victim's local environment is compromised; the attacker can modify or delete files accessible to the editor process.