CVE-2026-28338: PMD Static Code Analyzer XSS Vulnerability

CVE-2026-28338 Overview

PMD is an extensible multilanguage static code analyzer used by developers to identify common programming flaws. Prior to version 7.22.0, a Cross-Site Scripting (XSS) vulnerability exists in PMD's vbhtml and yahtml report formats. These legacy report formats insert rule violation messages into HTML output without proper escaping, allowing malicious JavaScript to be embedded in generated reports when PMD analyzes untrusted source code containing specially crafted string literals.

When a user opens the affected HTML report in a browser, the embedded JavaScript executes in the context of the user's session. While the practical impact is limited due to vbhtml and yahtml being legacy formats rarely used in production environments, organizations using these specific report formats are at risk. The default html format is properly escaped and is not affected by this vulnerability.

Critical Impact
Attackers can inject executable JavaScript into PMD HTML reports by embedding malicious payloads in analyzed source code, potentially leading to credential theft or session hijacking when reports are viewed in a browser.

Affected Products

PMD versions prior to 7.22.0
PMD vbhtml report format
PMD yahtml report format

Discovery Timeline

2026-02-27 - CVE CVE-2026-28338 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-28338

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The root cause lies in the improper handling of rule violation messages when generating HTML reports using the legacy vbhtml and yahtml report formats.

When PMD analyzes source code, it extracts various elements including string literals and code comments that may contain violation context. In the vulnerable report formats, these extracted values are inserted directly into the HTML output without proper sanitization or HTML entity encoding. An attacker who can influence the source code being analyzed can embed JavaScript payloads that will execute when the generated report is opened in a web browser.

The attack requires user interaction—specifically, a victim must open the malicious HTML report in a browser. The network attack vector indicates that crafted source code repositories could be shared remotely, and CI/CD pipelines generating PMD reports could inadvertently produce weaponized HTML files.

Root Cause

The vulnerability stems from insufficient output encoding in the vbhtml and yahtml report renderers. While the default html report format implements proper HTML entity escaping for special characters like <, >, ", and &, the legacy formats directly concatenate user-controlled input into the HTML document structure. This allows HTML tags and JavaScript event handlers embedded in source code strings to be interpreted as executable code rather than display text.

Attack Vector

An attacker can exploit this vulnerability by:

Creating malicious source code files containing JavaScript payloads within string literals, comments, or other scannable code elements
Ensuring the target organization analyzes this code using PMD with vbhtml or yahtml output format
Waiting for a user to open the generated HTML report in a browser

The malicious payload could steal session cookies, redirect users to phishing sites, or perform actions on behalf of the authenticated user within any web application context where the report is viewed.

The vulnerability manifests when rule violation messages containing unsanitized HTML/JavaScript are written directly to the report output. When the browser parses the malicious report, embedded script tags or event handlers execute automatically. See the GitHub Security Advisory for technical details on the specific code paths involved.

Detection Methods for CVE-2026-28338

Indicators of Compromise

Presence of <script> tags or JavaScript event handlers within PMD-generated HTML reports
Unusual string patterns in source code files containing HTML or JavaScript syntax designed to trigger XSS
HTML reports generated using vbhtml or yahtml format flags in CI/CD configurations
Browser security warnings when opening PMD reports

Detection Strategies

Review CI/CD pipeline configurations for use of -format vbhtml or -format yahtml flags in PMD commands
Implement Content Security Policy (CSP) headers when serving PMD reports through web servers
Scan generated HTML reports for suspicious JavaScript patterns before distribution
Monitor source code repositories for commits containing encoded XSS payloads in string literals

Monitoring Recommendations

Audit PMD configuration files across all projects to identify usage of vulnerable report formats
Implement automated scanning of generated reports for script injection patterns
Enable browser-based XSS protection headers when reports are served via HTTP

How to Mitigate CVE-2026-28338

Immediate Actions Required

Upgrade PMD to version 7.22.0 or later, which contains the fix for this vulnerability
Switch from vbhtml or yahtml report formats to the default html format, which properly escapes output
Review any previously generated reports using the vulnerable formats for signs of malicious content
Avoid analyzing untrusted source code with PMD until the upgrade is complete

Patch Information

The PMD project has released version 7.22.0 which addresses this vulnerability by implementing proper HTML entity encoding in the vbhtml and yahtml report formats. The fix is documented in GitHub Pull Request #6475 and the specific changes can be reviewed in commit c140c0e.

Organizations should update their PMD installations through their standard package management process or by downloading the latest release from the official PMD repository.

Workarounds

Use the default html report format instead of vbhtml or yahtml as it properly escapes output
Open PMD HTML reports only in sandboxed browser environments or with JavaScript disabled
Implement server-side sanitization of generated reports before distribution
Restrict PMD analysis to trusted source code only until patching is complete

bash

# Switch to safe HTML format in PMD command
pmd check -d src/main/java -R ruleset.xml -f html -r report.html

# Verify PMD version after upgrade
pmd --version
# Expected output: PMD 7.22.0 or later