« Volver al listado

CVE-2026-22718

Estado: AplazadaMedia (6.8)—

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microsoft — VscodeAIVmware — CLIAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22718",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22718",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-14T14:18:27.679388Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "CLI VSCode Extension",
          "versions": [
            {
              "status": "affected",
              "version": "0.9.0 and older"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-14T05:16:34.570",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-22718",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine."
    },
    {
      "lang": "es",
      "value": "La extensión de VSCode para Spring CLI es vulnerable a inyección de comandos, resultando en la ejecución de comandos en la máquina del usuario."
    }
  ],
  "lastModified": "2026-06-17T10:20:17.537",
  "sourceIdentifier": "security@vmware.com"
}