All vulnerabilities
CVE-2026-105111

Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Apache Software Foundation Apache Commons BCEL
Open in ThreatlineRecord JSON
CVSS
4.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.13.0Fixed versionCVE List
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.

This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).

This issue affects Apache Commons BCEL: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Text from CVE List

Affected versions 2

  • Apache Commons BCELaffected: all versions before 6.13.0CVE List
  • Apache Commons BCELaffected: all versions before fb72c225cbc6ec3d94060ed6edb269f07428d504CVE List

References 2