CVE-2026-12856

EUVD-2026-40084

29.06.2026, 14:16

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Argument Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 21.62%

Affected Products (NVD)

Vendor	Product	Version
redhat	openshift_dev_spaces	-

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat OpenShift Dev Spaces 3.29	1782989367 ≤ 𝑥 < *	ADP

Common Weakness Enumeration

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References

https://access.redhat.com/errata/RHSA-2026:36820

https://access.redhat.com/security/cve/CVE-2026-12856

https://bugzilla.redhat.com/show_bug.cgi?id=2491278

https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crv

https://access.redhat.com/errata/RHSA-2026:36820

https://access.redhat.com/security/cve/CVE-2026-12856

https://bugzilla.redhat.com/show_bug.cgi?id=2491278

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.json