Log in Start free

Vulnerability · Published Jun 29, 2026 · Assigned by redhat

CVE-2026-12856Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

High 8.8

In plain English

A high-severity argument injection in Red Hat OpenShift Dev Spaces 3.29 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat OpenShift Dev Spaces 3.29 see references

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References