Skip to content

Commit 07236dc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8rr6-2qw5-pc7r GHSA-j8cj-hw74-64jv
1 parent 7f3b8eb commit 07236dc

2 files changed

Lines changed: 138 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-8rr6-2qw5-pc7r/GHSA-8rr6-2qw5-pc7r.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8rr6-2qw5-pc7r",
4+
"modified": "2026-02-28T02:49:29Z",
5+
"published": "2026-02-28T02:49:29Z",
6+
"aliases": [
7+
"CVE-2026-28338"
8+
],
9+
"summary": "PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages",
10+
"details": "### Summary\nPMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser.\n\nWhile the default `html` format is not affected via rule violation messages (it correctly uses `StringEscapeUtils.escapeHtml4()`), it has a similar problem when rendering suppressed violations. The user supplied message (the reason for the suppression) was not escaped.\n\n### Details\n`VBHTMLRenderer.java` line 71 appends `rv.getDescription()` directly into HTML:\n\n```java\nsb.append(\"<td><font class=body>\").append(rv.getDescription()).append(\"</font></td>\");\n```\n\n`YAHTMLRenderer.java` lines 196–203 does the same via `renderViolationRow()`:\n\n```java\nprivate String renderViolationRow(String name, String value) {\n return \"<tr><td><b>\" + name + \"</b></td>\" + \"<td>\" + value + \"</td></tr>\";\n}\n```\n\nCalled at line 172:\n\n```java\nout.print(renderViolationRow(\"Description:\", violation.getDescription()));\n```\n\nThe violation message originates from `AvoidDuplicateLiteralsRule.java` line 91, which embeds raw string literal values via `first.toPrintableString()`. This calls `StringUtil.escapeJava()` (line 476–480), which is a Java source escaper — it passes `<`, `>`, and `&` through unchanged because they are printable ASCII (0x20–0x7e).\n\nBy contrast, `HTMLRenderer.java` line 143 properly escapes:\n\n```java\nString d = StringEscapeUtils.escapeHtml4(rv.getDescription());\n```\n### PoC\n\n1. Create a Java file with 4+ duplicate string literals containing an HTML payload:\n\n```java\npublic class Exploit {\n String a = \"<img src=x onerror=alert(document.domain)>\";\n String b = \"<img src=x onerror=alert(document.domain)>\";\n String c = \"<img src=x onerror=alert(document.domain)>\";\n String d = \"<img src=x onerror=alert(document.domain)>\";\n}\n```\n\n2. Run PMD with the `vbhtml` format:\n\n```bash\npmd check -R category/java/errorprone.xml -f vbhtml -d Exploit.java -r report.html\n```\n\n3. Open `report.html` in a browser. A JavaScript alert executes showing `document.domain`.\n\nThe generated HTML contains the unescaped tag:\n\n```html\n<td><font class=body>The String literal \"<img src=x onerror=alert(document.domain)>\" appears 4 times in this file</font></td>\n```\n\nTested and confirmed on PMD 7.22.0-SNAPSHOT (commit bcc646c53d).\n\n### Impact\nStored cross-site scripting (XSS). Affects CI/CD pipelines that run PMD with `--format vbhtml` or `--format yahtml` on untrusted source code (e.g., pull requests from external contributors) and expose the HTML report as a build artifact. JavaScript executes in the browser context of anyone who opens the report.\n\nPractical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format has a similar issue with user messages from suppressed violations.\n\n### Fixes\n* See [#6475](https://github.com/pmd/pmd/issues/6475): \\[core] Fix stored XSS in VBHTMLRenderer and YAHTMLRenderer",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "net.sourceforge.pmd:pmd-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "7.22.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 7.21.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28338"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/pmd/pmd/pull/6475"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442"
57+
},
58+
{
59+
"type": "PACKAGE",
60+
"url": "https://github.com/pmd/pmd"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-79"
66+
],
67+
"severity": "MODERATE",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-02-28T02:49:29Z",
70+
"nvd_published_at": "2026-02-27T21:16:19Z"
71+
}
72+
}

‎advisories/github-reviewed/2026/02/GHSA-j8cj-hw74-64jv/GHSA-j8cj-hw74-64jv.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j8cj-hw74-64jv",
4+
"modified": "2026-02-28T02:48:45Z",
5+
"published": "2026-02-28T02:48:45Z",
6+
"aliases": [],
7+
"summary": "Hive has Double-free and Use After Free Vulnerabilities",
8+
"details": "`Drop` implementation for `Hive` did perform free, but so did `Hive::close`, which, at the end of the scope performed `Drop`, therefore triggering double-free.\n\nAdditionally, function `Hive::from_handle` was not marked as unsafe, making it, in combination with `as_handle` easy to clone and trigger double-free in safe code or triggering UB when using invalid pointer.",
9+
"severity": [],
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "crates.io",
14+
"name": "hivex"
15+
},
16+
"ranges": [
17+
{
18+
"type": "ECOSYSTEM",
19+
"events": [
20+
{
21+
"introduced": "0.2.0"
22+
},
23+
{
24+
"fixed": "0.2.1"
25+
}
26+
]
27+
}
28+
],
29+
"versions": [
30+
"0.2.0"
31+
]
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "WEB",
37+
"url": "https://codeberg.org/1millibyte/toolsnt/commit/f4c7a0d1fc4a08ce40bb76e447a69a6f383a916e"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://codeberg.org/1millibyte/toolsnt/issues/18"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://docs.rs/crate/hivex"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://docs.rs/crate/hivex/0.2.1/source"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0029.html"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-415",
59+
"CWE-416"
60+
],
61+
"severity": "MODERATE",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-02-28T02:48:45Z",
64+
"nvd_published_at": null
65+
}
66+
}

0 commit comments

Comments
 (0)