Executive Summary

This vulnerability exists in Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28. It is a code injection flaw in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript code. The attack works by embedding malicious content inside a wavedrom fenced code block within a specially crafted Markdown document.

The root cause is the unsanitized passing of wavedrom block content to the window.eval() function in the VS Code webview context. This enables attackers to abuse the extension's message passing mechanism and invoke arbitrary file writes on the local filesystem.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to arbitrary JavaScript execution within the VS Code webview context. This can allow attackers to perform unauthorized actions such as writing arbitrary files to the local filesystem.

Such actions can compromise the integrity and confidentiality of your system and data, potentially leading to further attacks or data loss.

Useful 0 Not Useful 0