6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28338

CVE-2026-28338: PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because vbhtml and yahtml are legacy formats rarely used in practice. The default html format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28338

CVE-2026-28338:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.sourceforge.pmd:pmd-core	maven	<= 7.21.0	7.22.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commit c140c0e1de5853a08efb84c9f91dfeb015882442 reveals a stored cross-site scripting (XSS) vulnerability in multiple PMD report renderers. The root cause is the failure to properly escape user-controllable content before embedding it into the generated HTML reports.

The investigation of the patch identified three key vulnerable functions:

net.sourceforge.pmd.renderers.VBHTMLRenderer.renderFileViolations: This function was found to be appending raw rule violation descriptions directly into the HTML for the vbhtml report format.
net.sourceforge.pmd.renderers.YAHTMLRenderer.renderViolationRow: Similarly, this function was used to build table rows in the yahtml report and directly included the violation description without escaping.
net.sourceforge.pmd.renderers.HTMLRenderer.glomSuppressions: Even the default html renderer was vulnerable, but in a different context. It failed to escape the user-provided message associated with a suppressed violation.

In all cases, the fix involved introducing and applying an escape method, which utilizes StringEscapeUtils.escapeHtml4, to sanitize the data before it is written to the HTML output. An attacker could exploit this by crafting malicious code (e.g., a Java string literal) that, when processed by PMD, would result in a report containing executable JavaScript.

Vulnerable functions

net.sourceforge.pmd.renderers.VBHTMLRenderer.renderFileViolations

pmd-core/src/main/java/net/sourceforge/pmd/renderers/VBHTMLRenderer.java

The function `renderFileViolations` directly appends the violation description, obtained from `rv.getDescription()`, into the HTML report without proper escaping. This allows for the injection of arbitrary HTML and JavaScript, leading to a stored cross-site scripting (XSS) vulnerability.

net.sourceforge.pmd.renderers.YAHTMLRenderer.renderViolationRow

pmd-core/src/main/java/net/sourceforge/pmd/renderers/YAHTMLRenderer.java

The function `renderViolationRow` constructs an HTML table row by concatenating the `value` parameter directly into the output. This function is called with the violation description, which is not escaped, resulting in a stored cross-site scripting (XSS) vulnerability. The patch renamed the function and added escaping.

net.sourceforge.pmd.renderers.HTMLRenderer.glomSuppressions

pmd-core/src/main/java/net/sourceforge/pmd/renderers/HTMLRenderer.java

The function `glomSuppressions` appends the user-supplied message for a suppressed violation, obtained from `sv.getUserMessage()`, directly into the HTML report. This message was not escaped, creating a stored cross-site scripting (XSS) vulnerability if a malicious message is provided.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.