maven package report

Is org.jvnet.hudson.plugins:pmd safe?

1 known vulnerability, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

1.1%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-687x-269m-7cv9, the advisory selected below

// advisories

GHSA-687x-269m-7cv9

HIGHCVE-2018-1000008

Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Affected: <= 3.49
Fixed in: 3.50
Weakness: CWE-611
Published: 2022-05-14
Source: github

GHSA NVD MITRE reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 02:58 UTC. The most recent advisory here was published 2022-05-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is org.jvnet.hudson.plugins:pmd safe? maven package security report | CyberXYZ