CVE-2019-7722: Pmd Project Pmd

High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days.

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Affected products

• Pmd Project Pmd: up to and including 5.8.1

Published 2019-02-11. Last modified 2026-06-17.