Description (CNA)
Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| shd101wyy / Markdown Preview Enhanced | affected 0 before 0.8.28 |
CWE
CWE-78
References
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28
- https://www.vulncheck.com/advisories/markdown-preview-enhanced-os-command-injection-in-external-file-and-link-opening
ADP enrichment
No English description supplied.
No references supplied.