CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

• CWE-88
• CWE-88

• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
• https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crvBroken Link
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.jsonVendor Advisory

Published

Jun 29, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12848GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-12849Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-1285An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…7.5
• CVE-2026-12850Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12851Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12852In Bouncy Castle for Java before 1.85, MLS wire decoder allo…8.7
• CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exi…6.5
• CVE-2026-12860In Bouncy Castle for Java before 1.85, RSA PKCS#1 verificati…8.7
• CVE-2026-12862Untrusted user data was passed verbatim to Excel exports for…5.1
• CVE-2026-12863An unvalidated redirect was contained in Venueless' social l…5.1
• CVE-2026-12866All versions of the package expr-eval are vulnerable to Code…9.8
• CVE-2026-12869The Header Footer Builder for Elementor WordPress plugin bef…6.1