{"id":"AZL-108014","summary":"CVE-2026-105111 affecting package bcel 5.2-37","details":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","modified":"2026-10-15T05:32:31Z","published":"2026-10-06T20:17:15Z","upstream":["CVE-2026-105111"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105111"}],"affected":[{"package":{"name":"bcel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/bcel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2-37"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108014.json"}}],"schema_version":"1.9.0"}