PT-2026-22398 · Pmd · Pmd

Smaranchand · Published 2026-02-27 · Updated 2026-02-28 · CVE-2026-28338

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0

Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted source code with crafted string literals can lead to the generation of HTML reports containing executable JavaScript code that runs when the report is opened in a web browser. The default html format is not affected. The practical impact is limited as vbhtml and yahtml are legacy formats rarely used.

Recommendations Update to PMD version 7.22.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28338

GHSA-8RR6-2QW5-PC7R

Affected Products

Pmd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28338.json · Exploit
• https://github.com/pmd/pmd/pull/6475 · Patch
• https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r · Vendor Advisory
• https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28338 · Security Note
• https://osv.dev/vulnerability/GHSA-8rr6-2qw5-pc7r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28338 · Vendor Advisory
• https://github.com/pmd/pmd · Note
• https://twitter.com/_cvereports/status/2027597170069696796 · Twitter Post
• https://twitter.com/CVEnew/status/2027744238054539535 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027610379870712100 · Twitter Post