{"action":"Upgrade net.sourceforge.pmd:pmd-core to 7.22.0 or later.","affected":[{"fixed":"7.22.0","introduced":"0"}],"component":"net.sourceforge.pmd:pmd-core","cve_ids":["CVE-2026-28338"],"ecosystem":"Maven","epss":0.00346,"exploited":false,"fixed_versions":["7.22.0"],"ghsa_id":"GHSA-8rr6-2qw5-pc7r","id":"tcs_01M5N8NDGXYX5TAZSM0GNJ6HGC","modified_at":"2026-02-28T06:56:20.134050Z","published_at":"2026-02-28T02:49:29Z","references":["https://osv.dev/vulnerability/GHSA-8rr6-2qw5-pc7r","https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r","https://nvd.nist.gov/vuln/detail/CVE-2026-28338","https://github.com/pmd/pmd/pull/6475","https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442","https://github.com/pmd/pmd"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-8rr6-2qw5-pc7r","url":"https://osv.dev/vulnerability/GHSA-8rr6-2qw5-pc7r"}],"summary":"PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages"}