CVE-2026-105111

Apache Commons BCEL before 6.13.0 has a stored cross-site scripting flaw in its Class2HTML utility (CWE-79). Class2HTML emitters write strings taken from class files into generated HTML without escaping, so a report built from an attacker-controlled class file can contain injected script. Anyone who later views that HTML in a browser can have script run in that page context; the published CVSS 4.0 score is 2.3 (low), with no impact on the vulnerable system’s confidentiality, integrity, or availability and only limited subsequent-system impact, and the issue requires a user to view the report. Only deployments that use Class2HTML on possibly untrusted class files and then display the resulting pages are affected; ordinary BCEL bytecode processing is not described as vulnerable. No public proof of concept is known, and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Upgrade Apache Commons BCEL to 6.13.0. Until then, do not run Class2HTML on untrusted or attacker-supplied class files, and do not serve or open the generated HTML in a browser context that can access sensitive data.