CVE-2026-105111: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Apache Software Foundation Apache Commons BCEL
Description
CVE-2026-105111 is a cross-site scripting (XSS) vulnerability in Apache Commons BCEL that occurs when using the Class2HTML tool to generate web pages from class files that may be attacker-controlled. The vulnerability arises because Class2HTML emitters write class-file strings into HTML without proper escaping, leading to stored XSS in generated reports. This issue affects versions before 6.13.0. Upgrading to version 6.13.0 resolves the vulnerability.
CVSS v3.1
Score 4.7medium
Affected software
Apache Software Foundation
Apache Commons BCEL
pkg:maven/Apache Software Foundation/org.apache.bcel:bcelRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Commons BCEL versions prior to 6.13.0 contain an improper neutralization of input vulnerability (CWE-79) during web page generation by the Class2HTML component. When Class2HTML processes potentially attacker-controlled class files, it emits strings directly into HTML without escaping, resulting in stored cross-site scripting. This vulnerability is fixed in version 6.13.0.
Potential Impact
An attacker who can supply class files to the Class2HTML tool may cause malicious scripts to be embedded in generated HTML reports. This can lead to stored XSS, allowing attackers to execute scripts in the context of users viewing these reports. The CVSS score is 4.7 (medium severity), reflecting limited attack complexity and partial impact on confidentiality and integrity.
Mitigation Recommendations
Users should upgrade Apache Commons BCEL to version 6.13.0 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-03T12:02:46.675Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac550db2cdf04f656d8a124
Added to database: 10/06/2026, 19:49:47 UTC
Last enriched: 10/06/2026, 20:19:38 UTC
Last updated: 10/06/2026, 20:19:38 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.