CVE-2026-105111

Medium

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.

SeverityMedium

CVSS4.7

Exploit probability—

ProductApache Commons BCEL

PublishedOct 6, 2026

First seenOct 6, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

Apache Software Foundation Apache Commons BCEL6.13.0, fb72c225cbc6ec3d94060ed6edb269f07428d504 or later

Patches

github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch

Vendor advisories

lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6

Affected products

Product	Affected versions	Fixed in
Apache Software Foundation Apache Commons BCEL	v < 6.13.0, v < fb72c225cbc6ec3d94060ed6edb269f07428d504	6.13.0, fb72c225cbc6ec3d94060ed6edb269f07428d504

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.