Spring CLI VSCode Extension Command Injection Vulnerability Allowing Command Execution
Vulnerability
A command injection vulnerability has been identified in the Spring CLI VSCode extension, specifically in versions 0.9.0 and older. This vulnerability allows for command execution on the user's machine. Although the extension reached end-of-life on May 14, 2025, this CVE has been issued to address the vulnerability out of an abundance of caution.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the user's machine.
Remediation
Users of the Spring CLI VSCode extension should remove it from their coding environments.
Added: Jan 14, 2026, 5:19 AM
Updated: Jan 14, 2026, 5:19 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
4.4remediation
0.0relevance
2.1threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.