CVE-2026-11422 is an improper neutralization of directives in dynamically evaluated code (CWE-95) vulnerability affecting Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28. The vulnerability exists in the WaveDrom rendering pipeline where malicious content embedded in a wavedrom fenced code block is passed unsanitized to window.eval() within the VS Code webview context. This allows attackers to execute arbitrary JavaScript code, abuse the extension's message passing mechanism, and perform arbitrary file writes on the local filesystem. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the VS Code webview context, leading to high confidentiality and integrity impacts. Specifically, attackers can abuse the extension's message passing to invoke arbitrary file writes on the local filesystem, potentially compromising user data and system integrity. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted Markdown documents containing wavedrom fenced code blocks in Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28. Monitor vendor communications for updates and apply patches once released.