CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

As cited

Copy frozen at 2026-10-07 09:28 UTC (site build).

vulnerabilities

CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Apache Commons BCEL versions before 6.13.0 contain a stored cross-site scripting (XSS) vulnerability in the Class2HTML component, which fails to escape class strings during web page generation. The issue affects users who process untrusted Java class files through the library's HTML generation functionality.

Why it matters: Developers and organizations using Apache Commons BCEL to generate HTML output from Java bytecode should upgrade to version 6.13.0 or later to prevent attackers from injecting malicious scripts into generated pages.

Source published

2026-10-07 04:52 UTC

First seen by Cybersecurity Tracker

2026-10-07 07:50 UTC