The vulnerability is a command injection flaw in the Spring CLI VSCode Extension. An attacker can cause the extension to run arbitrary shell commands on the host system, potentially compromising confidentiality, integrity, and availability of the machine.

The Spring CLI VSCode Extension for Visual Studio Code is vulnerable. No specific affected versions are listed in the advisory.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is below 1 %, implying a low likelihood of exploitation in the wild. Based on the description, the likely attack vector is local and requires the extension to be installed; an adversary would typically need user interaction or local privileges to trigger the injection. The vulnerability is not in the CISA KEV catalog, so no publicly known exploitation has been reported.