CVE-2025-23215

Passphrases for GPG keys used to sign PMD and PMD Designer releases were included directly in JAR archives published to the Maven Central repository (CWE-540: storage of sensitive data in code/artifacts, CWE-312: storage of unencrypted data, CWE-200: information disclosure). Anyone downloading these archives could read the passphrase and potentially use it to gain access to the associated private key. In response to the incident, both keys were revoked, preventing their further use.

An attacker with access to the disclosed passphrase could potentially exploit the compromised private key to sign fraudulent artifacts, enabling distribution of malicious software masquerading as legitimate PMD releases. However, the vendor notes that artifacts published on Maven Central under the net.sourceforge.pmd group were not compromised, and their signatures are valid.

Both compromised signing keys have been revoked by the vendor, preventing their further use. The authenticity of PMD artifacts in use should be verified and configuration should be updated to versions using new, secure keys according to instructions in the vendor's official security advisory (GHSA-88m4-h43f-wx84). Organizations using GPG signature verification should update trusted keys in their CI/CD pipelines.

PMD and PMD Designer — versions whose JAR archives containing passphrases were published on Maven Central; specific versions indicated in vendor references (advisory GHSA-88m4-h43f-wx84)