https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:30:50.472228+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-05T23:30:50.519891+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-274128 EUVD-2026-274128 2026-10-05T23:30:50.519935+00:00 EUVD-2026-274128 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28338 fkie_cve-2026-28338 2026-10-05T23:30:50.519950+00:00

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-8rr6-2qw5-pc7r GHSA-8rr6-2qw5-pc7r — PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages 2026-10-05T23:30:50.519984+00:00

Affected: Maven: net.sourceforge.pmd:pmd-core

### Summary PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser.

While the default `html` format is not affected via rule violation messages (it correctly uses `StringEscapeUtils.escapeHtml4()`), it has a similar problem when rendering suppressed violations. The user supplied message (the reason for the suppression) was not escaped.

### Details `VBHTMLRenderer.java` line 71 appends `rv.getDescription()` directly into HTML:

```java sb.append("<td><font class=body>").append(rv.getDescription()).append("</font></td>"); ```

`YAHTMLRenderer.java` lines 196–203 does the same via `renderViolationRow()`:

```java private String renderViolationRow(String name, String value) { return "<tr><td><b>" + name + "</b></td>" + "<td>" + value + "</td></tr>"; } ```

Called at line 172:

```java out.print(renderViolationRow("Description:", violation.getDescription())); ```

The violation message originates from `AvoidDuplicateLiteralsRule.java` line 91, which embeds raw string literal values via `first.toPrintableString()`. This calls `StringUtil.escapeJava()` (line 476–480), which is a Java source escaper — it passes `<`, `>`, and `&` through unchanged because they are printable ASCII (0x20–0x7e).

By contrast, `HTMLRenderer.java` line 143 properly escapes:

```jav…