CVE-2026-105111

MediumCVSS 4.7

Published: 06/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Improper neutralization of input during web page generation ('cross-site scripting') in Apache Commons BCEL. This occurs when using Class2HTML to generate webpages for possibly attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). Affects versions before 6.13.0.

Risk Assessment

An attacker could inject malicious JavaScript into generated HTML reports, potentially leading to session theft or other actions in the victim's browser.

Recommendation

Upgrade Apache Commons BCEL to version 6.13.0, which fixes the issue. Avoid generating HTML reports from untrusted class files without additional sanitization.

Other vulnerabilities in Apache Commons BCEL

CVE-2026-94114Medium
In Apache Commons BCEL before 6.13.0, there is an issue with symbolic name mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS