CVE-2026-28338: 
Java vulnerability analysis and mitigation

CVE-2026-28338 is a stored cross-site scripting (XSS) vulnerability in PMD, an extensible multilanguage static code analyzer. The flaw exists in PMD's legacy vbhtml and yahtml report formats, which insert rule violation messages into HTML output without proper HTML escaping. All PMD versions up to and including 7.21.0 (Maven package net.sourceforge.pmd:pmd-core) are affected; version 7.22.0 contains the fix. The vulnerability was disclosed on February 27, 2026, with a CVSS v3.1 score of 6.8 (Moderate) (Github Advisory, PMD Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In VBHTMLRenderer.java, rv.getDescription() is appended directly into HTML output without escaping (e.g., sb.append("").append(rv.getDescription()).append("")). Similarly, YAHTMLRenderer.java passes violation descriptions through renderViolationRow() without HTML encoding. The violation message content originates from rules like AvoidDuplicateLiteralsRule, which uses StringUtil.escapeJava() — a Java source escaper that passes HTML special characters (<, >, &) through unchanged. By contrast, the default HTMLRenderer.java correctly uses StringEscapeUtils.escapeHtml4(). Additionally, the default html format had a secondary issue where user-supplied suppression messages were also unescaped. A public proof-of-concept is included in the security advisory (PMD Advisory, Fix PR).

When a developer or security analyst opens a PMD-generated HTML report (in vbhtml or yahtml format) produced from untrusted source code, malicious JavaScript embedded in the report executes in their browser at their privilege level. This could lead to unauthorized access to sensitive data accessible to the analyst, modification of systems they can interact with, or compromise of their local browser session. Practical impact is limited because vbhtml and yahtml are legacy formats rarely used in modern pipelines; the primary risk scenario is CI/CD pipelines that analyze external pull requests with these formats and expose the resulting HTML report as a build artifact (PMD Advisory, Github Advisory).

1. Craft malicious source code: Create a Java file containing four or more duplicate string literals that embed an HTML/JavaScript payload, exploiting the AvoidDuplicateLiteralsRule. For example:

public class Exploit {
    String a = "<script>alert(document.domain)</script>";
    String b = "<script>alert(document.domain)</script>";
    String c = "<script>alert(document.domain)</script>";
    String d = "<script>alert(document.domain)</script>";
}

2. Submit to target pipeline: Introduce the malicious file into a repository or submit it as a pull request to a project that runs PMD with --format vbhtml or --format yahtml on untrusted code.
3. Trigger PMD analysis: Wait for the CI/CD pipeline to execute PMD: pmd check -R category/java/errorprone.xml -f vbhtml -d Exploit.java -r report.html
4. Deliver the report: The generated report.html will contain the unescaped <script> tag embedded in the violation message: The String literal "<script>alert(document.domain)</script>" appears 4 times in this file.
5. Achieve XSS execution: When any user (e.g., a developer or security analyst) opens report.html in a browser, the JavaScript executes in their browser context, enabling session hijacking, credential theft, or further actions at their privilege level (PMD Advisory).

• File System: PMD-generated HTML report files (*.vb.html or *.html from yahtml format) containing unescaped <script> tags or other HTML event handler attributes within violation message text.
• Logs: CI/CD build logs showing PMD invocations with --format vbhtml or --format yahtml flags applied to externally contributed source code (e.g., pull requests from untrusted contributors).
• Source Code: Submitted Java (or other language) files containing four or more identical string literals with embedded HTML/JavaScript payloads, particularly targeting the AvoidDuplicateLiteralsRule.
• Network: Unexpected outbound requests from a developer's browser after opening a PMD HTML report, potentially indicating JavaScript-based data exfiltration (PMD Advisory).

Upgrade PMD to version 7.22.0 or later, which applies HTML escaping via StringEscapeUtils.escapeHtml4() in VBHTMLRenderer, YAHTMLRenderer, and also fixes the suppressed violation message escaping in HTMLRenderer (Fix Commit, Fix PR). If immediate patching is not possible, avoid using --format vbhtml or --format yahtml when analyzing untrusted source code, and use the default --format html instead (noting that suppressed violation messages in the default format were also fixed in 7.22.0). Additionally, restrict access to generated HTML reports and avoid opening them in browsers when they originate from untrusted code analysis (Github Advisory).

The vulnerability was reported by security researcher Smaran Chand (@smaranchand) and was promptly addressed by PMD maintainer adangel, who merged the fix on the same day it was disclosed (February 27, 2026). The fix was included in the PMD 7.22.0 milestone with release notes explicitly documenting the security fix. Red Hat also tracked the vulnerability for their products. No significant broader media coverage or notable community controversy has been observed, consistent with the limited practical impact of the legacy formats involved (PMD Advisory, Fix PR).