CVE-2026-12856CWE-88

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

High · published June 29, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-06-29T12:33Z
EPSS history
Timeline
  • 29 JUN 12:33Z
    Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension
    cvelistv5