PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
References
| Link | Resource |
|---|---|
| https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442 | Patch |
| https://github.com/pmd/pmd/pull/6475 | Issue Tracking Patch |
| https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r | Exploit Patch Vendor Advisory |
Configurations
History
03 Mar 2026, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:* | |
| First Time |
Pmd Project
Pmd Project pmd |
|
| References | () https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442 - Patch | |
| References | () https://github.com/pmd/pmd/pull/6475 - Issue Tracking, Patch | |
| References | () https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r - Exploit, Patch, Vendor Advisory |
27 Feb 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-27 21:16
Updated : 2026-03-03 18:43
NVD link : CVE-2026-28338
Mitre link : CVE-2026-28338
CVE.ORG link : CVE-2026-28338
JSON object : View
Products Affected
pmd_project
- pmd
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')