CVE-2026-28338

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28338", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T18:38:13.889Z", "datePublished": "2026-02-27T20:28:05.739Z", "dateUpdated": "2026-03-03T20:26:01.369Z"}, "containers": {"cna": {"title": "PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"}, {"name": "https://github.com/pmd/pmd/pull/6475", "tags": ["x_refsource_MISC"], "url": "https://github.com/pmd/pmd/pull/6475"}, {"name": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442", "tags": ["x_refsource_MISC"], "url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"}], "affected": [{"vendor": "pmd", "product": "pmd", "versions": [{"version": "< 7.22.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T20:28:05.739Z"}, "descriptions": [{"lang": "en", "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."}], "source": {"advisory": "GHSA-8rr6-2qw5-pc7r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T20:25:54.223576Z", "id": "CVE-2026-28338", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:26:01.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28338", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:25:54.223576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T20:25:58.288Z"}}], "cna": {"title": "PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages", "source": {"advisory": "GHSA-8rr6-2qw5-pc7r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pmd", "product": "pmd", "versions": [{"status": "affected", "version": "< 7.22.0"}]}], "references": [{"url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "name": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pmd/pmd/pull/6475", "name": "https://github.com/pmd/pmd/pull/6475", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442", "name": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T20:28:05.739Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28338", "state": "PUBLISHED", "dateUpdated": "2026-03-03T20:26:01.369Z", "dateReserved": "2026-02-26T18:38:13.889Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T20:28:05.739Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pmd", "vendor": "pmd", "versions": [{"status": "affected", "version": "< 7.22.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F87D181-4848-4FBA-AD46-2576B496C60B", "versionEndExcluding": "7.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."}, {"lang": "es", "value": "PMD es un analizador de c\u00f3digo est\u00e1tico multilenguaje extensible. Antes de la versi\u00f3n 7.22.0, los formatos de informe 'vbhtml' y 'yahtml' de PMD insertan mensajes de violaci\u00f3n de reglas en la salida HTML sin escapar. Cuando PMD analiza c\u00f3digo fuente no confiable que contiene literales de cadena manipulados, el informe HTML generado contiene JavaScript ejecutable que se ejecuta al abrirse en un navegador. El impacto pr\u00e1ctico es limitado porque 'vbhtml' y 'yahtml' son formatos heredados rara vez utilizados en la pr\u00e1ctica. El formato 'html' predeterminado est\u00e1 correctamente escapado y no se ve afectado. La versi\u00f3n 7.22.0 contiene una soluci\u00f3n para el problema."}], "id": "CVE-2026-28338", "lastModified": "2026-06-17T10:28:27.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28338", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T20:25:54.223576Z", "version": "2.0.3"}}]}, "published": "2026-02-27T21:16:19.017", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pmd/pmd/pull/6475"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.22.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pmd", "source": "cna", "vendor": "pmd"}, "product": "pmd", "vendor": "pmd"}], "analysis": {"en": {"generated_at": "2026-04-17T13:54:22.351970+00:00", "value": {"mitigation_remediation": ["Upgrade PMD to version 7.22.0 or newer, which applies proper escaping for all report formats.", "If upgrading is not possible, cease using the vbhtml or yahtml formats; generate reports only with the html formatter that safely escapes content.", "When producing reports from untrusted code, explicitly sanitize or escape violation messages before embedding them in HTML to prevent script execution."], "summary": {"action": "Apply Patch", "impact": "Stored XSS via unescaped violation messages"}, "threat_synthesis": {"affected_systems": "PMD is a static code analysis tool provided by PMD. The vulnerability affects versions of PMD prior to 7.22.0 that generate code\u2011analysis reports using the legacy vbhtml or yahtml formats. The root of the issue is the unescaped inclusion of rule violation messages into the generated HTML; any PMD installation that uses these formats to process untrusted source code is at risk. The default html format is escaped and safe, so systems that use only the standard html report format are not impacted.", "description_and_impact": "PMD is a static\u2011code analysis tool that can output rule violations in several formats. In releases before version 7.22.0 the vbhtml and yahtml reporters inserted violation messages directly into the generated HTML without escaping them. If those reporters process data that contains malicious strings, the resulting report will include executable JavaScript that runs when a user opens the file in a browser. The primary impact is that an attacker who supplies crafted source code and is able to deliver the resulting report to a browser session can run arbitrary code with the privileges of the browser user.\n\nAffected systems are installations of PMD before 7.22.0 that use the legacy vbhtml or yahtml report formats. The default html format is not affected, and the legacy formats are rarely used in current environments. The vulnerability is identified as CWE\u201179 (Cross\u2011Site Scripting).", "risk_and_exploitability": "Exploitability is limited to a scenario where an attacker supplies malicious source code to PMD, leading the output report to contain executable JavaScript that runs when opened in a browser. The CVSS score of 6.8 indicates moderate severity, but the EPSS score below 1% and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The legacy vbhtml and yahtml reports are rarely used in contemporary environments, further constraining the attack surface. The impact remains significant for systems that still generate or distribute these outdated reports from untrusted code sources."}}}}, "created": "2026-03-02T12:04:54.801938+00:00", "updated": "2026-04-17T14:00:15.809916+00:00", "vendors": ["pmd", "pmd$PRODUCT$pmd"]}