https://seclists.org/oss-sec/2026/q4/72: CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stod XSS
Published Oct 6, 2026
·Updated
Affected Software
1 affected component
Apache Commons BCEL<6.13.0
Deployments are exposed only if they use Class2HTML to generate web pages from class files that may be controlled by an attacker. The issue is a stored XSS in the generated reports, so exposure also requires those reports to be viewed in a browser.
An attacker needs to supply a crafted class file containing strings that Class2HTML will write into generated HTML without escaping. Exploitation also requires a user to view the resulting report.
The issue is not described as affecting BCEL generally by default; it occurs specifically when Class2HTML is used to generate pages for possibly attacker-controlled class files. Versions before 6.13.0 are affected under that usage condition.
Do not run Class2HTML on class files from untrusted or attacker-controlled sources, and avoid serving or viewing existing generated reports from such inputs. Upgrade to Apache Commons BCEL 6.13.0 when possible.
Identify Class2HTML-generated reports produced from class files that could have been supplied or modified by untrusted parties. Such reports may contain unescaped class-file strings and should be treated as potentially unsafe to open in a browser.