What is the CVSS score of CVE-2026-12856?

CVE-2026-12856 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of vscode-java are affected by CVE-2026-12856?

The Red Hat vscode-java extension and OpenShift Dev Spaces contain a critical vulnerability (CVE-2026-12856, CVSS 8.8) enabling arbitrary code execution on developer workstations through a single…. A patch is available.

How to fix or mitigate CVE-2026-12856?

Within 24 hours: Inventory all developers and environments using vscode-java extension and OpenShift Dev Spaces; issue security notice to cease opening untrusted Java source files. Within 7 days: Disable or uninstall the vscode-java extension across development fleet; mandate code review for all Java contributions to prevent malicious hover payloads. Within 30 days: Monitor Red Hat security advisories for patch release; develop remediation and re-enablement plan with validation procedures once patched versions become available.

vscode-java CVE-2026-12856

EUVD-2026-40084 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-06-29 redhat

GHSA-7vqr-7r5j-c84j

RCE Java Red Hat Openshift Dev Spaces Red Hat

8.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Malicious file is delivered remotely (AV:N) and trivially crafted (AC:L) with no auth (PR:N) but needs the victim's click (UI:R), and command execution yields full host compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:24 vuln.today

DescriptionCVE.org

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

AnalysisAI

Arbitrary VS Code command execution in the Red Hat vscode-java extension allows a malicious Java source file to embed hidden commands inside JavaDoc hover Markdown, so that a developer who simply clicks a crafted link in a hover popup triggers attacker-chosen commands that can escalate to full system compromise in trusted workspaces. The flaw stems from the extension rendering JavaDoc hovers as fully-trusted Markdown, and it also affects Red Hat OpenShift Dev Spaces, which bundles the extension. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network reach combined with only a single click of user interaction makes it high-impact.

Technical ContextAI

vscode-java (the redhat-developer Java language-support extension for Visual Studio Code, built on the Eclipse JDT Language Server) renders JavaDoc documentation as hover popups. VS Code Markdown can carry command: URIs and HTML, and trusted Markdown will execute registered VS Code commands when such links are activated. The root cause maps to CWE-88 (argument/command injection via improper neutralization): the extension marks JavaDoc-derived Markdown as trusted without sanitizing or stripping command-invoking links, so attacker-controlled JavaDoc comments are treated with the same authority as the IDE itself. Per the CPE data, the affected packaged product is cpe:2.3:a:red_hat:red_hat_openshift_dev_spaces, the Red Hat cloud developer-workspace platform that ships the vscode-java extension into browser-based IDE workspaces.

RemediationAI

Patch available per vendor advisory: update the vscode-java extension to the fixed release referenced in GHSA-7qv8-6qrw-3crv (https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crv) and apply the corresponding Red Hat OpenShift Dev Spaces update per https://access.redhat.com/security/cve/CVE-2026-12856 - an exact fixed version number was not provided in the input data and should be taken directly from those advisories rather than assumed. Until patched, the most effective compensating control is to rely on VS Code Workspace Trust: open untrusted or cloned Java projects in Restricted Mode, which prevents the trusted-Markdown command execution that this flaw depends on (trade-off: language features and some extension functionality are limited in Restricted Mode). Additionally, avoid clicking links inside JavaDoc hover popups in untrusted repositories and treat third-party Java projects as untrusted code, since the attack requires that single click to fire.