https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:44:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336521 EUVD-2026-336521 https://cve.radiocsirt.org/vuln/euvd-2026-336521 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11422 <p>Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension&#39;s message passing and invoke arbitrary file writes on the local filesystem.</p> <p>Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension&#39;s message passing and invoke arbitrary file writes on the local filesystem.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11422 https://cve.radiocsirt.org/vuln/ghsa-m48c-hxqg-4j76 <p>Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension&#39;s message passing and invoke arbitrary file writes on the local filesystem.</p> <p>Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension&#39;s message passing and invoke arbitrary file writes on the local filesystem.</p> https://cve.radiocsirt.org/vuln/ghsa-m48c-hxqg-4j76