VulnSocial

CVE-2026-50733Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-05); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-05: 1Mentions · 2026-06-08: 1Patch / Workaround · 2026-06-08: 1Technical Details · 2026-06-08: 106-0506-08
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-051
Disclosure1
2026-06-081
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-50733 - XSS in Markdown Preview Enhanced. WaveDrom diagrams eval() untrusted content, enabling arbitrary JS execution. CVSS 8.8. No patch available. Disable or avoid previewing/exporting untrusted markdown. #CVE #infosec #markdown #CVEAlert More FREE information https://www.valtersit.com/cve/CVE-2026-50733

    Post summary

    The post announces an XSS flaw in Markdown Preview Enhanced that allows arbitrary JavaScript execution, gives a CVSS score of 8.8, notes no patch is available yet, and advises disabling or avoiding previewing/exporting untrusted markdown.

    0000049
    921 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-50733 Arbitrary JavaScript Execution in Markdown Preview Enhanced Befor... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50733 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    A short tweet announcing CVE‑2026‑50733, highlighting arbitrary JavaScript execution in Markdown Preview Enhanced, but lacking technical, exploit, or patch details.

    0000068
    4.0K followersView on X

Explore more

Back to dashboard