CVE-2026-28338

{"id": "CVE-2026-28338", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28338", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T20:25:54.223576Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pmd", "product": "pmd", "versions": [{"status": "affected", "version": "< 7.22.0"}]}]}], "published": "2026-02-27T21:16:19.017", "references": [{"url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pmd/pmd/pull/6475", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue."}, {"lang": "es", "value": "PMD es un analizador de c\u00f3digo est\u00e1tico multilenguaje extensible. Antes de la versi\u00f3n 7.22.0, los formatos de informe 'vbhtml' y 'yahtml' de PMD insertan mensajes de violaci\u00f3n de reglas en la salida HTML sin escapar. Cuando PMD analiza c\u00f3digo fuente no confiable que contiene literales de cadena manipulados, el informe HTML generado contiene JavaScript ejecutable que se ejecuta al abrirse en un navegador. El impacto pr\u00e1ctico es limitado porque 'vbhtml' y 'yahtml' son formatos heredados rara vez utilizados en la pr\u00e1ctica. El formato 'html' predeterminado est\u00e1 correctamente escapado y no se ve afectado. La versi\u00f3n 7.22.0 contiene una soluci\u00f3n para el problema."}], "lastModified": "2026-06-17T10:28:27.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F87D181-4848-4FBA-AD46-2576B496C60B", "versionEndExcluding": "7.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}