The extension processes WaveDrom diagram descriptions by running them through eval, which lets an attacker inject arbitrary JavaScript into the preview context. The flaw can be triggered from any render path, including the live preview, presentation mode, or when exporting markdown to HTML. Successful exploitation grants the attacker full code execution inside the editor process, potentially allowing arbitrary file writes and other destructive actions on the host system.

All installations of shd101wyy Markdown Preview Enhanced prior to version 0.8.28 are vulnerable. The vulnerability applies to every render path in the extension, including live preview, presentation mode, and HTML export. The affected CPE is markdown_preview_enhanced_project:markdown_preview_enhanced.

The CVSS score of 8.6 labels the issue as high severity. No EPSS score is published, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw requires the user to open a crafted markdown file that contains a WaveDrom diagram, the most likely attack vector is local file exploitation via the editor. An attacker could place a malicious file on a shared drive or distribute it through phishing, knowing that any user who opens the file in VS Code with the extension will execute the malicious payload.