Script not executed in markdown preview after disabling security setting

[hedgehog-zizi]

Type: Bug

Issue #46424 is back.

1. Create and open a new markdown file in a workspace or as a standalone file.
2. Put some javascript into the file, ie.
   <script>document.write("hello");</script>
3. Open a preview of the markdown file. The javascript is not executed (the preview is empty)
4. Change preview security settings to disabled (using command pallete). The javascript is still not executed.

VS Code version: Code 1.106.3 (bf9252a, 2025-11-25T22:28:18.024Z)
OS version: Windows_NT x64 10.0.26100
Modes:

System Info

Item	Value
CPUs	12th Gen Intel(R) Core(TM) i7-12850HX (24 x 2419)
GPU Status	2d_canvas: enabled direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off trees_in_viz: disabled_off video_decode: enabled video_encode: enabled vulkan: disabled_off webgl: enabled webgl2: enabled webgpu: enabled webnn: disabled_off
Load (avg)	undefined
Memory (System)	63.69GB (21.18GB free)
Process Argv	C:\Development\.development\vbs-product.code-workspace --crash-reporter-id 3a6a3b75-8285-41bb-a758-c7a1feb29d9a
Screen Reader	no
VM	0%

Extensions: none

A/B Experiments

vsliv368:30146709
pythonvspyt551:31249599
binariesv615:30325510
nativeloc1:31344060
dwcopilot:31170013
dwoutputs:31242946
copilot_t_ci:31333650
e5gg6876:31282496
pythonrdcb7:31342333
aj953862:31281341
nes-set-on:31351930
63221493:31336333
envsdeactivate2:31353495
cloudbuttont:31379625
todos-1:31405332
v66_all_req:31402695
3efgi100_wstrepl:31403338
trigger-command-fix:31379601
auto_model_enabled:31385282
use-responses-api:31390855
2a0ce269:31419925
ec5jj548:31422691
terminalsuggestdisabled:31426256
cp_cls_c_966_ss:31426491
chatvisible:31426294
expandedtokens:31426297
c0683394:31419495
478ah919:31426797
b53de340:31426751
a5gib710:31426782

[mjbvz]

Works if you reload the preview:

It doesn't work if you open it and then change the setting without a reload. We don't have good support for updating scripts after the preview had been loaded

[hedgehog-zizi]

The refresh seems to work after all. It is clunky and little bit confusing since the changes in the markdown are updated in the preview. But for the javascript it needs to be refreshed.

I guess it works as intended then and the issue can be closed?

[NriotHrreion]

Sometimes, even the refresh doesn't work. Because the script tag is inserted into the preview html by the page script, so it is actually an async script.
If you call document.write directly inside that, a warning will be thrown to the devtools console: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.

document.open();
document.write(...);
document.close();

just does the trick.