Malicious JavaDoc Links Enable Arbitrary VS Code Command Execution

The vscode-java extension contains a critical input validation flaw (CWE-88: Argument Injection) where JavaDoc hover popups fail to sanitize Markdown content, allowing attackers to embed malicious links that execute arbitrary VS Code commands. When developers click these specially crafted links in JavaDoc hovers, attackers gain the ability to run any command available within VS Code's command palette—potentially leading to code execution, credential theft, or system compromise, especially in trusted workspaces where the extension has elevated privileges. This affects Java developers across Windows, macOS, and Linux who rely on vscode-java for IDE functionality, making it a significant supply chain risk targeting development environments.

While this CVE currently maps to zero Casky skills (as MITRE ATT&CK techniques weren't assigned), practitioners detecting this attack would typically identify patterns consistent with Execution and Command and Scripting Interpreter techniques. Casky's Claude-powered analysis engine would recognize the behavioral signature: unsanitized user input (JavaDoc) flowing into a command execution context (VS Code API), combined with social engineering (user clicking a link). During threat hunting, security teams using Casky would look for vscode-java processes spawning unexpected child processes, suspicious VS Code command invocations logged in workspace telemetry, or indicators of Markdown injection in project files. Extended reasoning across the 754 security skills would correlate this pattern with CWE-88 (argument injection) attack chains, enabling practitioners to prioritize detection of malicious Java files circulating in repositories and identify developers who may have clicked compromised links.