Detections
Analytics

SCA: security update for net.sourceforge.pmd:pmd-core (GHSA-8rr6-2qw5-pc7r)

medium Tenable Cloud Security Plugin ID 438042

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and
 `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD
 analyzes untrusted source code containing crafted string literals, the generated HTML report contains
 executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and
 `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not
 affected. Version 7.22.0 contains a fix for the issue. (CVE-2026-28338)

See Also

https://github.com/advisories/GHSA-8rr6-2qw5-pc7r

Plugin Details

Severity: Medium

ID: 438042

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/2/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-28338

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/28/2026

Vulnerability Publication Date: 2/28/2026

Reference Information

CVE: CVE-2026-28338

cwe: CWE-79