Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-28338
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-27 Feb, 2026 | 20:28
Updated At-27 Feb, 2026 | 20:28
Rejected At-
▼CVE Numbering Authority (CNA)
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

Affected Products
Vendor
pmd
Product
pmd
Versions
Affected
  • < 7.22.0
Problem Types
TypeCWE IDDescription
CWECWE-79CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Type: CWE
CWE ID: CWE-79
Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
VersionBase scoreBase severityVector
3.16.8MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Version: 3.1
Base score: 6.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
x_refsource_CONFIRM
https://github.com/pmd/pmd/pull/6475
x_refsource_MISC
https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
x_refsource_MISC
Hyperlink: https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/pmd/pmd/pull/6475
Resource:
x_refsource_MISC
Hyperlink: https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
Resource:
x_refsource_MISC
Details not found