Vulnerability-Lookup

CVE-2026-28338 (GCVE-0-2026-28338)

Vulnerability from cvelistv5 – Published: 2026-02-27 20:28 – Updated: 2026-03-03 20:26

Title

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

Summary

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/pmd/pmd/security/advisories/GH…	x_refsource_CONFIRM
	https://github.com/pmd/pmd/pull/6475	x_refsource_MISC
	https://github.com/pmd/pmd/commit/c140c0e1de5853a…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	pmd	pmd	Affected: < 7.22.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28338",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T20:25:54.223576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T20:26:01.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pmd",
          "vendor": "pmd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD\u0027s `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T20:28:05.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"
        },
        {
          "name": "https://github.com/pmd/pmd/pull/6475",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pmd/pmd/pull/6475"
        },
        {
          "name": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"
        }
      ],
      "source": {
        "advisory": "GHSA-8rr6-2qw5-pc7r",
        "discovery": "UNKNOWN"
      },
      "title": "PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28338",
    "datePublished": "2026-02-27T20:28:05.739Z",
    "dateReserved": "2026-02-26T18:38:13.889Z",
    "dateUpdated": "2026-03-03T20:26:01.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-28338",
      "date": "2026-04-18",
      "epss": "0.00019",
      "percentile": "0.05015"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-28338\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-27T21:16:19.017\",\"lastModified\":\"2026-03-03T18:43:33.240\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD\u0027s `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.\"},{\"lang\":\"es\",\"value\":\"PMD es un analizador de c\u00f3digo est\u00e1tico multilenguaje extensible. Antes de la versi\u00f3n 7.22.0, los formatos de informe \u0027vbhtml\u0027 y \u0027yahtml\u0027 de PMD insertan mensajes de violaci\u00f3n de reglas en la salida HTML sin escapar. Cuando PMD analiza c\u00f3digo fuente no confiable que contiene literales de cadena manipulados, el informe HTML generado contiene JavaScript ejecutable que se ejecuta al abrirse en un navegador. El impacto pr\u00e1ctico es limitado porque \u0027vbhtml\u0027 y \u0027yahtml\u0027 son formatos heredados rara vez utilizados en la pr\u00e1ctica. El formato \u0027html\u0027 predeterminado est\u00e1 correctamente escapado y no se ve afectado. La versi\u00f3n 7.22.0 contiene una soluci\u00f3n para el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.22.0\",\"matchCriteriaId\":\"2F87D181-4848-4FBA-AD46-2576B496C60B\"}]}]}],\"references\":[{\"url\":\"https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/pmd/pmd/pull/6475\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-28338\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-03T20:25:54.223576Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-03T20:25:58.288Z\"}}], \"cna\": {\"title\": \"PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages\", \"source\": {\"advisory\": \"GHSA-8rr6-2qw5-pc7r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"pmd\", \"product\": \"pmd\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 7.22.0\"}]}], \"references\": [{\"url\": \"https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r\", \"name\": \"https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pmd/pmd/pull/6475\", \"name\": \"https://github.com/pmd/pmd/pull/6475\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442\", \"name\": \"https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD\u0027s `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-27T20:28:05.739Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-28338\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-03T20:26:01.369Z\", \"dateReserved\": \"2026-02-26T18:38:13.889Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-27T20:28:05.739Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-8RR6-2QW5-PC7R

Vulnerability from github – Published: 2026-02-28 02:49 – Updated: 2026-02-28 02:49

Summary

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

Details

Summary

PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser.

While the default html format is not affected via rule violation messages (it correctly uses StringEscapeUtils.escapeHtml4()), it has a similar problem when rendering suppressed violations. The user supplied message (the reason for the suppression) was not escaped.

Details

VBHTMLRenderer.java line 71 appends rv.getDescription() directly into HTML:

sb.append("<td><font class=body>").append(rv.getDescription()).append("</font></td>");

YAHTMLRenderer.java lines 196–203 does the same via renderViolationRow():

private String renderViolationRow(String name, String value) {
    return "<tr><td><b>" + name + "</b></td>" + "<td>" + value + "</td></tr>";
}

Called at line 172:

out.print(renderViolationRow("Description:", violation.getDescription()));

The violation message originates from AvoidDuplicateLiteralsRule.java line 91, which embeds raw string literal values via first.toPrintableString(). This calls StringUtil.escapeJava() (line 476–480), which is a Java source escaper — it passes <, >, and & through unchanged because they are printable ASCII (0x20–0x7e).

By contrast, HTMLRenderer.java line 143 properly escapes:

String d = StringEscapeUtils.escapeHtml4(rv.getDescription());

PoC

Create a Java file with 4+ duplicate string literals containing an HTML payload:

public class Exploit {
    String a = "<img src=x onerror=alert(document.domain)>";
    String b = "<img src=x onerror=alert(document.domain)>";
    String c = "<img src=x onerror=alert(document.domain)>";
    String d = "<img src=x onerror=alert(document.domain)>";
}

Run PMD with the vbhtml format:

pmd check -R category/java/errorprone.xml -f vbhtml -d Exploit.java -r report.html

Open report.html in a browser. A JavaScript alert executes showing document.domain.

The generated HTML contains the unescaped tag:

<td><font class=body>The String literal "<img src=x onerror=alert(document.domain)>" appears 4 times in this file</font></td>

Tested and confirmed on PMD 7.22.0-SNAPSHOT (commit bcc646c53d).

Impact

Stored cross-site scripting (XSS). Affects CI/CD pipelines that run PMD with --format vbhtml or --format yahtml on untrusted source code (e.g., pull requests from external contributors) and expose the HTML report as a build artifact. JavaScript executes in the browser context of anyone who opens the report.

Practical impact is limited because vbhtml and yahtml are legacy formats rarely used in practice. The default html format has a similar issue with user messages from suppressed violations.

Fixes

See #6475: [core] Fix stored XSS in VBHTMLRenderer and YAHTMLRenderer

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.21.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "net.sourceforge.pmd:pmd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-28T02:49:29Z",
    "nvd_published_at": "2026-02-27T21:16:19Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nPMD\u0027s `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser.\n\nWhile the default `html` format is not affected via rule violation messages (it correctly uses `StringEscapeUtils.escapeHtml4()`), it has a similar problem when rendering suppressed violations. The user supplied message (the reason for the suppression) was not escaped.\n\n### Details\n`VBHTMLRenderer.java` line 71 appends `rv.getDescription()` directly into HTML:\n\n```java\nsb.append(\"\u003ctd\u003e\u003cfont class=body\u003e\").append(rv.getDescription()).append(\"\u003c/font\u003e\u003c/td\u003e\");\n```\n\n`YAHTMLRenderer.java` lines 196\u2013203 does the same via `renderViolationRow()`:\n\n```java\nprivate String renderViolationRow(String name, String value) {\n    return \"\u003ctr\u003e\u003ctd\u003e\u003cb\u003e\" + name + \"\u003c/b\u003e\u003c/td\u003e\" + \"\u003ctd\u003e\" + value + \"\u003c/td\u003e\u003c/tr\u003e\";\n}\n```\n\nCalled at line 172:\n\n```java\nout.print(renderViolationRow(\"Description:\", violation.getDescription()));\n```\n\nThe violation message originates from `AvoidDuplicateLiteralsRule.java` line 91, which embeds raw string literal values via `first.toPrintableString()`. This calls `StringUtil.escapeJava()` (line 476\u2013480), which is a Java source escaper \u2014 it passes `\u003c`, `\u003e`, and `\u0026` through unchanged because they are printable ASCII (0x20\u20130x7e).\n\nBy contrast, `HTMLRenderer.java` line 143 properly escapes:\n\n```java\nString d = StringEscapeUtils.escapeHtml4(rv.getDescription());\n```\n### PoC\n\n1. Create a Java file with 4+ duplicate string literals containing an HTML payload:\n\n```java\npublic class Exploit {\n    String a = \"\u003cimg src=x onerror=alert(document.domain)\u003e\";\n    String b = \"\u003cimg src=x onerror=alert(document.domain)\u003e\";\n    String c = \"\u003cimg src=x onerror=alert(document.domain)\u003e\";\n    String d = \"\u003cimg src=x onerror=alert(document.domain)\u003e\";\n}\n```\n\n2. Run PMD with the `vbhtml` format:\n\n```bash\npmd check -R category/java/errorprone.xml -f vbhtml -d Exploit.java -r report.html\n```\n\n3. Open `report.html` in a browser. A JavaScript alert executes showing `document.domain`.\n\nThe generated HTML contains the unescaped tag:\n\n```html\n\u003ctd\u003e\u003cfont class=body\u003eThe String literal \"\u003cimg src=x onerror=alert(document.domain)\u003e\" appears 4 times in this file\u003c/font\u003e\u003c/td\u003e\n```\n\nTested and confirmed on PMD 7.22.0-SNAPSHOT (commit bcc646c53d).\n\n### Impact\nStored cross-site scripting (XSS). Affects CI/CD pipelines that run PMD with `--format vbhtml` or `--format yahtml` on untrusted source code (e.g., pull requests from external contributors) and expose the HTML report as a build artifact. JavaScript executes in the browser context of anyone who opens the report.\n\nPractical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format has a similar issue with user messages from suppressed violations.\n\n### Fixes\n* See [#6475](https://github.com/pmd/pmd/issues/6475): \\[core] Fix stored XSS in VBHTMLRenderer and YAHTMLRenderer",
  "id": "GHSA-8rr6-2qw5-pc7r",
  "modified": "2026-02-28T02:49:29Z",
  "published": "2026-02-28T02:49:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28338"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pmd/pmd/pull/6475"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pmd/pmd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages"
}

FKIE_CVE-2026-28338

Vulnerability from fkie_nvd - Published: 2026-02-27 21:16 - Updated: 2026-03-03 18:43

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442	Patch
security-advisories@github.com	https://github.com/pmd/pmd/pull/6475	Issue Tracking, Patch
security-advisories@github.com	https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r	Exploit, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	pmd_project	pmd	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F87D181-4848-4FBA-AD46-2576B496C60B",
              "versionEndExcluding": "7.22.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD\u0027s `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."
    },
    {
      "lang": "es",
      "value": "PMD es un analizador de c\u00f3digo est\u00e1tico multilenguaje extensible. Antes de la versi\u00f3n 7.22.0, los formatos de informe \u0027vbhtml\u0027 y \u0027yahtml\u0027 de PMD insertan mensajes de violaci\u00f3n de reglas en la salida HTML sin escapar. Cuando PMD analiza c\u00f3digo fuente no confiable que contiene literales de cadena manipulados, el informe HTML generado contiene JavaScript ejecutable que se ejecuta al abrirse en un navegador. El impacto pr\u00e1ctico es limitado porque \u0027vbhtml\u0027 y \u0027yahtml\u0027 son formatos heredados rara vez utilizados en la pr\u00e1ctica. El formato \u0027html\u0027 predeterminado est\u00e1 correctamente escapado y no se ve afectado. La versi\u00f3n 7.22.0 contiene una soluci\u00f3n para el problema."
    }
  ],
  "id": "CVE-2026-28338",
  "lastModified": "2026-03-03T18:43:33.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-27T21:16:19.017",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/pmd/pmd/pull/6475"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-28338 (GCVE-0-2026-28338)

GHSA-8RR6-2QW5-PC7R

Summary

Details

PoC

Impact

Fixes

FKIE_CVE-2026-28338

Tags

Sightings

Nomenclature