CVE-2026-12856

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Dev Spaces 3.29	—
Red Hat	Red Hat OpenShift Dev Spaces 3.29	—

References

https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crvBroken Link
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.jsonVendor Advisory

Timeline

Published: Jun 29, 2026
Last modified: Oct 25, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-128588.5Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC.CVE-2026-128596.5Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly CVE-2026-12866.5CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote c CVE-2026-128605.3In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bounc CVE-2026-128625.1Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise CVE-2026-128635.1An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.CVE-2026-1286375.1The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied CVE-2026-128657.1The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribut CVE-2026-128669.8All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScr CVE-2026-128696.1The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard templa CVE-2026-12875.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in col CVE-2026-128729.8The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any auth