What’s Vulnerable › Vulnerabilities

CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-07
• Weakness: CWE-79

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Commons BCEL: before 6.13.0 — fixed in 6.13.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Commons BCEL 6.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch
• https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6
• http://www.openwall.com/lists/oss-security/2026/10/07/13

Get alerted when CVE-2026-105111 or the next vulnerability affects your stack