High

Command Injection in Markdown Preview Enhanced before 0.8.28

IdentifiersCVE-2026-49492CWE-78· Improper Neutralization of Special…

Markdown Preview Enhanced before version 0.8.28 processes certain preview-triggered external files and links through a shell and fails to properly validate untrusted values embedded in markdown content. The exposed inputs include the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can supply shell metacharacters or otherwise malicious values through these fields, causing operating system commands to be injected and executed when the document is previewed. The issue was fixed in 0.8.28 by passing these values as literal arguments rather than through a shell and by validating them before use.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary OS command execution on Windows in the security context of the user previewing the malicious markdown document. This can lead to compromise of confidentiality, integrity, and availability, including execution of attacker-controlled programs or scripts, access to local data available to the user, modification or deletion of files, and follow-on activity such as persistence or lateral movement depending on the user's privileges and environment.

Mitigation

If you can’t patch tonight, do this now.

Do not preview untrusted markdown documents in affected versions. Until patching is complete, restrict or disable features that open external files and links from the preview where possible, and avoid use of markdown content that leverages diagram filename attributes, imported file paths, or latex_engine code-chunk attributes from untrusted sources. On Windows, additional containment such as least-privilege user contexts and application sandboxing can reduce impact.

Remediation

Patch, then assume compromise.

Upgrade Markdown Preview Enhanced to version 0.8.28 or later. The fixed release eliminates shell-based handling for the affected inputs by passing them as literal arguments and adds validation before use. Ensure all installations, including editor/plugin deployments that bundle or depend on Markdown Preview Enhanced, are updated to a non-vulnerable version.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Markdown Preview Enhanced ProjectMarkdown Preview Enhancedapplication

Shd101wyyMarkdown Preview Enhancedapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cvefeed high severityNews

Jun 5, 2026

CVE-2026-49492 - Markdown Preview Enhanced OS Command Injection in External File and Link Opening

An OS command injection vulnerability in Markdown Preview Enhanced before version 0.8.28 that allows a crafted markdown document to execute operating system commands on Windows when previewed.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3