CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
AI summary · grok-4.7Summaries by Vani AI
Apache Commons BCEL Class2HTML before 6.13.0 emits unescaped class strings, enabling stored XSS (CVE-2026-105111).
Apache Commons BCEL before 6.13.0 has a stored cross-site scripting flaw, CVE-2026-105111, because Class2HTML writes class strings into generated pages without escaping. Apache rates severity low. CVSS 3.1 is 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) and CVSS 4.0 is 2.3. The fix is in 6.13.0 and commit fb72c225cbc6ec3d94060ed6edb269f07428d504.
Key facts
- CVE-2026-105111 is stored XSS in BCEL Class2HTML output.
- Class strings are emitted without escaping during HTML generation.
- Apache rates it low; CVSS 3.1 is 4.7 and CVSS 4.0 is 2.3.
- Fixed in Apache Commons BCEL 6.13.0; user interaction is required.
- CVEs
- CVE-2026-105111
- Vendors
- Apache Software Foundation
- Products
- Apache Commons BCELClass2HTML
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105111 | Stored XSS in Apache Commons BCEL Class2HTML | 2.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | fb72c225cbc6ec3d94060ed6edb269f07428d504 | che Commons BCEL before 6.13.0 - Apache Commons BCEL before fb72c225cbc6ec3d94060ed6edb269f07428d504 Description: Improper neutralization of input during web pa |
From the original article
Posted by Gary D. Gregory on Oct 06 Severity: low CVSS 3. 1: 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.