CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compromise in trusted workspaces.

• CWE-88
• CWE-88

• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
• https://github.com/redhat-developer/vscode-java/security/advisories/GHSA-7qv8-6qrw-3crvBroken Link
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/security/cve/CVE-2026-12856Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491278Issue Tracking, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12856.jsonVendor Advisory

Published

Jun 29, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1285An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…7.5
• CVE-2026-12850Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12851Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12852In Bouncy Castle for Java before 1.85, MLS wire decoder allo…7.5
• CVE-2026-12853The Flamingo plugin for WordPress is vulnerable to authoriza…5.4
• CVE-2026-12855Unvalidated memory boundary could result in arbitrary code e…8.2
• CVE-2026-12858Improper Privilege Management vulnerability in ESET AV Remov…8.5
• CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exi…6.5
• CVE-2026-12860In Bouncy Castle for Java before 1.85, RSA PKCS#1 verificati…5.3
• CVE-2026-12862Untrusted user data was passed verbatim to Excel exports for…5.1
• CVE-2026-12863An unvalidated redirect was contained in Venueless' social l…5.1
• CVE-2026-12865The Photo Gallery by 10Web WordPress plugin before 1.8.44 d…7.1