CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Commons BCELto a version that resolves this vulnerability.Fixed in 6.13.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Apache Commons BCEL versions before 6.13.0 are exposed only if they use Class2HTML to generate web pages from class files that may be controlled by an attacker. The generated reports can contain stored cross-site scripting payloads.
What must an attacker do to exploit it?
An attacker needs to supply a crafted class file whose string values are included in Class2HTML output. A user must then view the generated HTML page for the script to execute.
Is a default BCEL installation affected?
The issue is conditional on use of the Class2HTML webpage-generation feature with potentially attacker-controlled class files. The provided information does not indicate that ordinary BCEL use without Class2HTML report generation is affected.
What is the remediation?
Upgrade Apache Commons BCEL to version 6.13.0. This version fixes the unescaped class-string output in Class2HTML.