CVE-2026-28338

MEDIUM EPSS 21.3%
Published Feb 27, 20264mo ago · Modified Mar 3, 20264mo ago
6.1 CVSS 3.1
Medium
Find Similar
Published Feb 27, 2026 4mo ago
Last Modified Mar 3, 2026 4mo ago

Description

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
21.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
pmd_projectpmd* <7.22.0

References 3

  • github.com https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
    Patch
  • github.com https://github.com/pmd/pmd/pull/6475
    Issue TrackingPatch
  • github.com https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
    ExploitPatchVendor Advisory

Remediation

  • github.com https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
    Patch
  • github.com https://github.com/pmd/pmd/pull/6475
    Issue TrackingPatch
  • github.com https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
    ExploitPatchVendor Advisory