CVE-2026-28338
1 advisory.
Maven/net.sourceforge.pmd:pmd-core CVE-2026-28338: medium 6.8
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
Action: Upgrade net.sourceforge.pmd:pmd-core to 7.22.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.22.0 | - |
Fixed versions
| 7.22.0 |
Sources
- osv: GHSA-8rr6-2qw5-pc7r
- https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
- https://nvd.nist.gov/vuln/detail/CVE-2026-28338
- https://github.com/pmd/pmd/pull/6475
- https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
- https://github.com/pmd/pmd
CVE-2026-28338 · published · modified · JSON