XSS in Pmd
CVE-2026-28338
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Pmd — versions < 7.22.0
- Pmd Project
Weakness classification (CWE)
References
- github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r (Exploit, Patch, Vendor Advisory)
- github.com/pmd/pmd/pull/6475 (Patch, Issue Tracking)
- github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442 (Patch)
Frequently asked questions
- What is CVE-2026-28338?
- CVE-2026-28338 is a medium-severity vulnerability in Pmd, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-02-27.
- How severe is CVE-2026-28338?
- Medium severity. CVSS v3 base score is 6.8 out of 10.