Read the docs
TI-2026-10972 Aliases CVE-2026-12856GHSA-7vqr-7r5j-c84j

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

Priority MEDIUM 41CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-88.

Summary

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat OpenShift Dev Spaces 3.29—1782989367Patch availableCNA
  • Red Hat OpenShift Dev Spaces 3.29 VendorRed Hat Affected — Fixed in 1782989367 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2026:36820 Released 2026-07-08 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.0 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:36820
Not affected: 1 product
  • Red Hat OpenShift Dev Spaces 3.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12856
  2. 2026-10-03 Alias added: GHSA-7vqr-7r5j-c84j

References

Advisory 4

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences