CVE-2026-22718CWE-78

Command injection vulnerability

Medium · published January 14, 2026

CVSS v3.1
6.8
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00579 · 46.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-14T05:10Z
EPSS history
Timeline
  • 14 JAN 05:10Z
    Command injection vulnerability
    cvelistv5