8.8
HIGH CVSS 3.1
CVE-2026-12856
Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension
Description

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

INFO

Published Date :

June 29, 2026, 12:33 p.m.

Last Modified :

June 29, 2026, 12:38 p.m.

Remotely Exploit :

Yes !

Source :

redhat
Affected Products

The following products are affected by CVE-2026-12856 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redhat openshift_dev_spaces
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 53f830b8-0a3f-465b-8143-3b8a9948e749
CVSS 3.1 HIGH MITRE-CVE
Solution
Update the vscode-java extension to a version that properly sanitizes JavaDoc hover content.
  • Update the vscode-java extension immediately.
  • Avoid opening untrusted Java files in VS Code.
  • Review VS Code security settings for extensions.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-12856 vulnerability anywhere in the article.

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.