CVE-2026-22718: EOL Spring CLI Tool for VS Code Found Vulnerable to Command Injection

Developers using the Spring CLI VSCode Extension have been urged to remove it after a vulnerability, CVE-2026-22718, was found in the now-defunct extension that could allow an attacker to execute arbitrary commands on a user’s machine. The flaw is rated with a CVSS score of 6.6 and is described as a Command Injection vulnerability that could let input be manipulated to run system-level commands.

The vulnerability affects Spring CLI VSCode Extension version 0.9.0 and older, and since the product is unsupported there will be no patch. The extension reached EOL on 14 May 2025, and the advisory warns that, with no fix coming, the only secure option is to uninstall the extension entirely. The risk was identified by security researcher Yue Liu, who noted the issue in the legacy code and urged regular auditing of installed extensions to remove those no longer maintained or supported.