CVE-2026-12856

Katalog CVE

CVSS 8.8 · High EPSS 0,55%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada redhat openshift dev spaces. Skor CVSS 3.1 8.8 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

Rincian

Terbit di NVD

29 Juni 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-12856 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2491278 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.json advisory vendor
• https://access.redhat.com/errata/RHSA-2026:36820
• https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crv broken link