CVE-2026-28338
PMD is an extensible multilanguage static code analyzer.
Published Feb 27, 2026 · updated Jun 17, 2026 · pmd project pmd
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's and report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because and are legacy formats rarely used in practice. The default format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 27, 2026 · NIST NVD
Detected
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's and report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because and are legacy formats
Jun 17, 2026 · NIST NVD
Updated
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's and report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because and are legacy formats
Affected
- cpe pmd project/pmdversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-28338
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's and report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated
nvd.nist.gov