Vulnerabilities - Language Support for Java(TM) by Red Hat - Visual Studio Code

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/03/13

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

CVSS Score

CVE

Summary

Tags

critical

9.8

Plexus-utils is vulnerable to command injection due to incorrect processing of double quoted strings.

Vulnerability Triaged

Fix Available

high

8.7

Apache Commons IO's XmlStreamReader may excessively consume CPU resources when processing maliciously crafted input.

Fix Available

high

7.5

Codeplex-codehaus is vulnerable to a directory traversal attack, allowing access to arbitrary files and directories outside the intended folder.

Vulnerability Triaged

Fix Available

medium

5.9

QOS.CH logback-core allows arbitrary code execution via compromised configuration file or environment variable injection.

Vulnerability Triaged

Fix Available

medium

4.3

Codehaus Plexus is vulnerable to XML injection due to the XmlWriterUtil#writeComment function failing to sanitize comments for a --> sequence.

Vulnerability Triaged

Fix Available

low

1.8

QOS.CH logback-core allows instantiation of classes on the class path by compromising an existing logback configuration file.

Fix Available

Language Support for Java(TM) by Red Hat