CVE-2026-28338: PMD Designer Vulnerability in VBHTMLRenderer and YAHTMLRenderer Leading to Stored XSS
Summary
CVE-2026-28338: PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages. Affects net.sourceforge.pmd:pmd-core versions < 7.22.0. Fixed in 7.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PMD is an open-source static code analysis tool that helps developers identify potential issues in their Java code. It provides various report formats, including vbhtml and yahtml, which are used to present rule violation messages. However, these formats have a critical vulnerability that allows unescaped HTML content to be included in the generated reports, posing a risk of stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the way PMD's vbhtml and yahtml report formats handle rule violation messages. These messages are inserted into HTML output without proper escaping, allowing attackers to inject executable JavaScript when untrusted source code is analyzed. The issue is particularly concerning when PMD is used in CI/CD pipelines, as the generated reports may be exposed as build artifacts. If an attacker crafts a Java file with malicious string literals, the resulting HTML report can execute JavaScript in the browser context of anyone who opens it, leading to potential data theft or session hijacking.
How To Fix
Minimum fixed version
7.22.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vbhtml and yahtml formats for generating reports, and instead use the default html format, which properly escapes violation messages. This can be done by running PMD with the following command:
pmd check -R category/java/errorprone.xml -f html -d Exploit.java -r report.html
Conclusion
The vulnerability identified as CVE-2026-28338 in PMD's vbhtml and yahtml report formats poses a significant risk of stored XSS attacks. It is crucial for users to update to the patched version 7.22.0 or later to mitigate this risk. Additionally, using alternative report formats can serve as a temporary workaround until an update can be applied.
See every vulnerability recorded for net.sourceforge.pmd:pmd-core →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can help you determine if your application is affected.
The primary impact is the risk of stored XSS attacks, which can lead to unauthorized access to sensitive information or user sessions when the generated reports are opened in a browser.
No, this vulnerability is present in versions prior to 7.22.0. It has been fixed in version 7.22.0 and later.
If you cannot update immediately, avoid using the vbhtml and yahtml formats for generating reports and use the default html format instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.sourceforge.pmd:pmd-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
