XSS in Pmd
CVE-2026-28338
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Affected products
- Pmd — versions < 7.22.0
- Pmd_project Pmd
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-28338?
- CVE-2026-28338 is a medium-severity vulnerability in Pmd, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-02-27.
- How severe is CVE-2026-28338?
- Medium severity. CVSS v3 base score is 6.8 out of 10.