Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

net.sourceforge.pmd:pmd-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8MavenPublished

    PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

    CVE-2026-28338 · GHSA-8rr6-2qw5-pc7r

    Affected
    • Maven net.sourceforge.pmd:pmd-core <= 7.21.0
    Fixed in
    7.22.0· Vendor fix available
    Issue
    PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. While the default html format is not affected via rule violation messages (it correctly uses StringEscapeUtils.escapeHtml4()), it has a similar problem when rendering suppressed violations. The user supplied message (the reason for the suppression) was not escaped. Details VBHTMLRenderer.java line 71 appends rv.getDescription() directly into HTML: YAHTMLRenderer.java lines 196–203 does the same via renderViolationRow(): Called at line 172: The violation message originates from AvoidDuplicateLiteralsRule.java line 91, which embeds raw string literal values via first.toPrintableString(). This calls StringUtil.escapeJava() (line 476–480), which is a Java source escaper — it passes <, , and & through unchanged…

    Recommended action: Upgrade to 7.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.1MavenPublished

    Improper Restriction of XML External Entity Reference in PMD

    CVE-2019-7722 · GHSA-57qj-79gh-69w8

    Affected
    • Maven net.sourceforge.pmd:pmd-core <= 5.8.1
    Fixed in
    6.0.0· Vendor fix available
    Issue
    PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

    Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →