CVE-2026-12856highCWE-88

CVE-2026-12856: falha de alta gravidade em Red Hat OpenShift Dev Spaces 3.29

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift Dev Spaces

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Red Hat · Red Hat OpenShift Dev Spaces 3.29