CVE-2026-105111

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0

Description Improper neutralization of input during web page generation leads to cross-site scripting (XSS), a condition where malicious scripts are injected into trusted websites. This occurs when using the Class2HTML emitter to generate webpages from class files that may be controlled by an attacker, as the emitter writes class-file strings into HTML without proper escaping, resulting in stored XSS in the reports.

Recommendations Upgrade to version 6.13.0.