PT-2026-22398 · Pmd · Pmd

Smaranchand · Publicado 2026-02-27 · Atualizado 2026-02-28 · CVE-2026-28338

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0

Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted source code with crafted string literals can lead to the generation of HTML reports containing executable JavaScript code that runs when the report is opened in a web browser. The default html format is not affected. The practical impact is limited as vbhtml and yahtml are legacy formats rarely used.

Recommendations Update to PMD version 7.22.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28338

GHSA-8RR6-2QW5-PC7R

Produtos afetados

Pmd

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28338.json · Exploit
• https://github.com/pmd/pmd · Nota
• https://github.com/pmd/pmd/pull/6475 · Correção
• https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r · Aviso do Fabricante
• https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442 · Correção
• https://twitter.com/_cvereports/status/2027597170069696796 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027744238054539535 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28338 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2027610379870712100 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8rr6-2qw5-pc7r · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28338 · Aviso do Fabricante