CVE-2026-12856
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-06-29 14:16:41.473000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-12856",
"sourceIdentifier": "[email protected]",
"published": "2026-06-29T14:16:41.473",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en la extensión vscode-java, que proporciona soporte para el lenguaje Java para Visual Studio Code. La extensión confía incorrectamente en todo el contenido Markdown en las vistas previas de JavaDoc, lo que permite que un archivo Java malicioso incluya comandos ocultos. Si un usuario hace clic en un enlace especialmente diseñado dentro de una ventana emergente de vista previa de JavaDoc, un atacante puede ejecutar comandos arbitrarios de VS Code, lo que puede llevar a un compromiso total del sistema en espacios de trabajo de confianza."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/pluginregistry-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"versions": [
{
"version": "1782989367",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/pluginregistry-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"versions": [
{
"version": "1782989367",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-29T00:00:00+00:00",
"id": "CVE-2026-12856",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-88"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-88"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*",
"matchCriteriaId": "99B8A88B-0B31-4CFF-AFD7-C9D3DDD5790D"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:36820",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-12856",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491278",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crv",
"source": "[email protected]",
"tags": [
"Broken Link"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36820",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-12856",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491278",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
}
]
}