CVE-2026-12856 HIGH

CVE-2026-12856: Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Weakness CWE-88
Published June 29, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Key dates

02Disclosure timeline

June 29, 2026 CVE published
June 30, 2026 Record updated