Description
A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift Dev Spaces 3.29
Default version status: affected
1782989367 to < *unaffected
References
- https://access.redhat.com/errata/RHSA-2026:36820 ↗
- https://access.redhat.com/security/cve/CVE-2026-12856 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2491278 ↗
- https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crv ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.json ↗