PT-2026-22398

CVE-2026-28338

Published

2026-02-27

Updated

2026-02-28

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0

Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted source code with crafted string literals can lead to the generation of HTML reports containing executable JavaScript code that runs when the report is opened in a web browser. The default html format is not affected. The practical impact is limited as vbhtml and yahtml are legacy formats rarely used.

Recommendations Update to PMD version 7.22.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Smaranchand

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers