CVE-2026-49492 describes an OS command injection vulnerability in Markdown Preview Enhanced before version 0.8.28. The vulnerability arises from the application's practice of opening external files and links via a shell on Windows without validating untrusted inputs derived from markdown documents, specifically the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. This allows an attacker to craft a markdown document that injects and executes arbitrary operating system commands during preview. The vulnerability was addressed in version 0.8.28 by changing the input handling to pass arguments literally and adding validation steps.

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on a Windows system when a malicious markdown document is previewed. This can lead to system compromise, data loss, or other impacts depending on the executed commands. The CVSS 4.0 base score is 8.6 (high severity), reflecting network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Upgrade Markdown Preview Enhanced to version 0.8.28 or later, where the vulnerability is fixed by proper input validation and safe argument passing. Until upgrading, avoid previewing untrusted markdown documents on Windows systems. Patch status is not explicitly confirmed in the provided data, but the fix is stated to be in version 0.8.28. Check the vendor's official advisory or release notes for confirmation and further guidance.