Executive brief
A security vulnerability exists in the Java language support extension for Visual Studio Code. This extension, which helps developers write and read Java code, incorrectly handles documentation popups (JavaDoc hovers). If a developer opens a malicious Java file and clicks a link within one of these popups, an attacker could execute unauthorized commands on the developer's computer, potentially leading to a full system takeover.
Technical details
A command injection vulnerability exists in the JavaDoc hover provider of the vscode-java extension. The root cause is the improper neutralization of Markdown content within JavaDoc hovers, which allows for the inclusion of hidden or malicious commands. An attacker can exploit this by providing a specially crafted Java file; if a user interacts with a link in the resulting hover popup within a trusted workspace, the attacker can execute arbitrary VS Code commands. This vulnerability is tracked as CWE-88 (Argument Injection) and has been identified in Red Hat OpenShift Dev Spaces and the standalone vscode-java extension.
Affected products
- Red Hat vscode-java extension unspecified
- Red Hat OpenShift Dev Spaces 3
Timeline
- 2026-06-22: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-29: advisory: NVD publication date