CVE-2026-11422

The record

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Affected packages

Related vulnerabilities

• CVE-2026-85165 n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free… CWE-95
• CVE-2026-19295 IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute… CWE-95
• CVE-2026-54569 SENAITE.CORE is the core framework for the SENAITE laboratory information management… CWE-95
• CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in… CWE-95
• CVE-2026-71867 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
• CVE-2026-71865 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
• CVE-2026-71866 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
• CVE-2026-71864 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95