CVE-2026-12856

Name of the Vulnerable Software and Affected Versions vscode-java (affected versions not specified)

Description The vscode-java extension, which provides Java language support for Visual Studio Code, incorrectly trusts all Markdown content in JavaDoc hovers. This allows a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, potentially leading to full system compromise in trusted workspaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.