CVE-2026-28338

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442	Patch
https://github.com/pmd/pmd/pull/6475	Issue Tracking Patch
https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-27 21:16

Updated : 2026-06-17 10:28

NVD link : CVE-2026-28338

Mitre link : CVE-2026-28338

CVE.ORG link : CVE-2026-28338

JSON object : View

Products Affected

pmd_project

pmd

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-28338", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28338", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:25:54.223576Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pmd", "product": "pmd", "versions": [{"status": "affected", "version": "< 7.22.0"}]}]}], "published": "2026-02-27T21:16:19.017", "references": [{"url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pmd/pmd/pull/6475", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."}, {"lang": "es", "value": "PMD es un analizador de c\u00f3digo est\u00e1tico multilenguaje extensible. Antes de la versi\u00f3n 7.22.0, los formatos de informe 'vbhtml' y 'yahtml' de PMD insertan mensajes de violaci\u00f3n de reglas en la salida HTML sin escapar. Cuando PMD analiza c\u00f3digo fuente no confiable que contiene literales de cadena manipulados, el informe HTML generado contiene JavaScript ejecutable que se ejecuta al abrirse en un navegador. El impacto pr\u00e1ctico es limitado porque 'vbhtml' y 'yahtml' son formatos heredados rara vez utilizados en la pr\u00e1ctica. El formato 'html' predeterminado est\u00e1 correctamente escapado y no se ve afectado. La versi\u00f3n 7.22.0 contiene una soluci\u00f3n para el problema."}], "lastModified": "2026-06-17T10:28:27.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F87D181-4848-4FBA-AD46-2576B496C60B", "versionEndExcluding": "7.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}