Java Language Support Flaw in Visual Studio Code Extension by Red Hat
CVE-2026-12856

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Dev Spaces
Vendor
CVE Published:
29 June 2026

What is CVE-2026-12856?

A vulnerability has been identified in the vscode-java extension for Visual Studio Code that compromises the trust model for Markdown content in JavaDoc hovers. This flaw allows malicious Java files to embed concealed commands. If an unsuspecting user interacts with a specially crafted link in a JavaDoc hover popup, it could result in the execution of arbitrary commands in Visual Studio Code, posing a significant risk of full system compromise, particularly in secure environments.

References

https://access.redhat.com/security/cve/CVE-2026-12856
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2491278
issue-trackingx_refsource_REDHAT
https://github.com/redhat-developer/vscode-java/security/...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank byte256 for reporting this issue.
.