Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28338 PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML … https://www.cve.org/CVERecord?id=CVE-2026-28338
Post summary
The CVE describes a vulnerability in PMD’s report formats that could lead to unintended HTML content injection, but no exploitation details, patches, or PoC are mentioned.
CVE-2026-28338 Cross-Site Scripting in PMD Static Code Analyzer via Unescaped HTML Report Formats https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28338
Post summary
CVE-2026-28338 is a disclosed cross‑site scripting flaw in PMD's static code analyzer that arises from unescaped HTML in report formats, but the provided information offers only the base disclosure; no PoC, exploit, patch, or active exploitation details are included.
CVE-2026-28338: PMD Static Analyzer Stored XSS in HTML Reports A Stored Cross-Site Scripting (XSS) vulnerability exists in the HTML report generation components of PMD, a popular extensible multilanguage static code analyzer. The flaw allows attackers... https://cvereports.com/reports/CVE-2026-28338
Post summary
The text discloses a stored XSS vulnerability in PMD's HTML report generation, detailing the nature of the flaw but providing no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pmd_project | pmd | - | - | - |