CVE-2026-49492 – Markdown Preview Enhanced OS Command Injection in External File and Link Opening

CVE ID :CVE-2026-49492

Published : June 5, 2026, 6:17 p.m. | 15 minutes ago

Description :Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document – the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…