The vulnerability CVE-2026-12856 affects the vscode-java extension integrated with Red Hat OpenShift Dev Spaces. The extension improperly trusts all Markdown content in JavaDoc hovers, enabling an attacker to craft Java files that include hidden commands. When a user interacts with a specially crafted link in the JavaDoc hover popup, arbitrary VS Code commands may be executed. This can escalate to full system compromise within trusted workspaces. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory does not specify remediation or patch availability.

Successful exploitation allows an attacker to execute arbitrary VS Code commands by tricking a user into clicking a malicious link in a JavaDoc hover popup. This can lead to full system compromise in trusted workspaces, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12856 for current remediation guidance. Until a fix is available, users should exercise caution when interacting with JavaDoc hover popups, especially from untrusted sources. No official fix or temporary workaround is documented in the provided advisory content.