Markdown Preview Enhanced prior to version 0.8.28 improperly neutralizes special elements used in OS commands, leading to an OS command injection vulnerability on Windows. The vulnerability arises from opening external files and links via a shell without validating untrusted inputs extracted from markdown documents, including diagram filename attributes, imported file paths, and latex_engine code-chunk attributes. This allows an attacker to craft markdown documents that execute arbitrary operating system commands during preview. The vulnerability is resolved in version 0.8.28 by changing the handling of these inputs to pass them as literal arguments instead of through a shell and by validating inputs before use.

An attacker can execute arbitrary operating system commands on Windows systems by crafting malicious markdown documents that exploit unvalidated inputs in the preview feature. This can lead to high-impact consequences such as system compromise or data loss. The CVSS 4.0 score is 8.6 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Upgrade Markdown Preview Enhanced to version 0.8.28 or later, where this vulnerability is fixed by proper input validation and passing inputs as literal arguments instead of through a shell. No other mitigation is required once updated.