{"id":"CVE-2026-105111","summary":"Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS","details":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue.","modified":"2026-10-09T17:26:55.446143122Z","published":"2026-10-06T19:44:18.075Z","related":["openSUSE-SU-2026:12080-1"],"database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105111.json","cna_assigner":"apache"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/07/13"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105111.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105111"},{"type":"FIX","url":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch"},{"type":"PACKAGE","url":"https://gitbox.apache.org/repos/asf/commons-bcel.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitbox.apache.org/repos/asf/commons-bcel.git","events":[{"introduced":"0"},{"fixed":"fb72c225cbc6ec3d94060ed6edb269f07428d504"}]},{"type":"GIT","repo":"https://github.com/apache/commons-bcel","events":[{"introduced":"0"},{"fixed":"be4bc45e5ee623b4d074a0b0888da828822dd9b3"},{"fixed":"fb72c225cbc6ec3d94060ed6edb269f07428d504"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.13.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["rel/commons-bcel-6.8.1","commons-bcel-6.8.1-RC1","rel/commons-bcel-6.8.0","commons-bcel-6.8.0-RC1","rel/commons-bcel-6.6.0","commons-bcel-6.6.0-RC1","rel/commons-bcel-6.5.0","commons-bcel-6.5.0-RC1","rel/commons-bcel-6.4.1","commons-bcel-6.4.1-RC1","rel/commons-bcel-6.4.0","commons-bcel-6.4.0-RC2","commons-bcel-6.4.0-RC1","commons-bcel-6.3.1","commons-bcel-6.3.1-RC1"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/main/java/org/apache/bcel/util/MethodHTML.java","function":"writeField"},"deprecated":false,"digest":{"length":998,"function_hash":"326763463435560253468034361808780896131"},"id":"CVE-2026-105111-0230494d","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504"},{"signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"function":"writeConstant","file":"src/main/java/org/apache/bcel/util/ConstantHTML.java"},"deprecated":false,"digest":{"function_hash":"102166359680356773874044976360179276733","length":5243},"id":"CVE-2026-105111-071ca3a1","signature_type":"Function"},{"deprecated":false,"digest":{"length":1865,"function_hash":"55328601519474346378269817497251330189"},"id":"CVE-2026-105111-0cb4b90a","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/MethodHTML.java","function":"writeMethod"}},{"source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/Class2HTML.java"},"deprecated":false,"digest":{"line_hashes":["246737784068709867689392001224969396451","102417088336958536661237791077745312979","332766928815090860661876436301382680206","204923748217826683585174340911669928324","217748784823748562789462960041273842837","141838486536023333662484658755018781767","220153607111190258030848993580483389137","151461097413735256047066549769621423259","276204812965403557920909344781926845054","162126202498838470203193371064762120603","33833665756271908604716393422274061475","117562790858737561342304950389387832981","150132404496800494234682555510452664714","192243693333491500882538099033887424134"],"threshold":0.9},"id":"CVE-2026-105111-121b8ff4","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/main/java/org/apache/bcel/util/ConstantHTML.java","function":"writeConstant"},"deprecated":false,"digest":{"function_hash":"102166359680356773874044976360179276733","length":5243},"id":"CVE-2026-105111-121e69c1","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504"},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/CodeHTML.java"},"deprecated":false,"digest":{"line_hashes":["262610257031764994041091045251692759574","171393737718853338107263010907724618207","99756512033697226030295733703638960496","252895594134630429524791317746432731335"],"threshold":0.9},"id":"CVE-2026-105111-3addd58c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/test/java/org/apache/bcel/util/Class2HTMLXSSTest.java"},"deprecated":false,"digest":{"line_hashes":["145928049342105337108266718080442416223","85786969405755020778471729088107978746"],"threshold":0.9},"id":"CVE-2026-105111-47050d21","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/MethodHTML.java"},"deprecated":false,"digest":{"line_hashes":["317092009247675207656316651811696448725","150559804261760797370329865374132179709","153204816056102220572775991786824056279","127772943320775764918024350787191150394","2692614902117793886664974994055975831","338893028188942052435172942467895356476","225505085448242297083817493800108228284","30537075721427850024388246090371266333","316317317673241791516604095960112047369","251899689894133370337094176702828487050","188469336330839277385609893830459782443","306970416209778452426731356003855730623"],"threshold":0.9},"id":"CVE-2026-105111-471146c9","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["145928049342105337108266718080442416223","85786969405755020778471729088107978746"],"threshold":0.9},"id":"CVE-2026-105111-48ca2829","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/test/java/org/apache/bcel/util/Class2HTMLXSSTest.java"},"deprecated":false},{"source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/CodeHTML.java","function":"codeToHTML"},"deprecated":false,"digest":{"function_hash":"277339837409611992417107106867092807545","length":9174},"id":"CVE-2026-105111-606e207e","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/ConstantHTML.java"},"deprecated":false,"digest":{"line_hashes":["203866820074141232392721418387227447593","7666763342247812475413612258738203723","118081033196207647289413064766007913882","142221628666471802938396895651909420508","286376523162716129750727641820629286261","34218736699715163802628254982951283260","96170156681267877429809734869896109565","11279565312462125661080609579014012914","278748797035141246963926197471535465647","136151713364699095650371436300263189164","177192799614865949825105928421878163635","78979736271002659801002331816602552007","182314925989612739855549432483083248602","209277623120944387609627920834029009481"],"threshold":0.9},"id":"CVE-2026-105111-7521849d"},{"id":"CVE-2026-105111-911686ae","signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"function":"referenceType","file":"src/main/java/org/apache/bcel/util/Class2HTML.java"},"deprecated":false,"digest":{"function_hash":"204705887809301787245737958603979191367","length":447}},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"function":"codeToHTML","file":"src/main/java/org/apache/bcel/util/CodeHTML.java"},"deprecated":false,"digest":{"length":9174,"function_hash":"277339837409611992417107106867092807545"},"id":"CVE-2026-105111-91be624c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"88446034129442143867015411049593817693","length":453},"id":"CVE-2026-105111-a6b34c5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/Class2HTML.java","function":"toHTML"}},{"digest":{"line_hashes":["317092009247675207656316651811696448725","150559804261760797370329865374132179709","153204816056102220572775991786824056279","127772943320775764918024350787191150394","2692614902117793886664974994055975831","338893028188942052435172942467895356476","225505085448242297083817493800108228284","30537075721427850024388246090371266333","316317317673241791516604095960112047369","251899689894133370337094176702828487050","188469336330839277385609893830459782443","306970416209778452426731356003855730623"],"threshold":0.9},"id":"CVE-2026-105111-aac8fb86","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/MethodHTML.java"},"deprecated":false},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/AttributeHTML.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226907598356993166384295375483405615976","274301446251762422415392824580175349052","210831633171073621393554960191410782602","238029531524346651707596438964609001658","226981035551455322130644609679595934425","208476283131738943725747342582302771134","226274668091310747055030864321792227363","180323139516738842111097830446942104586"]},"id":"CVE-2026-105111-aae04f16","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["246737784068709867689392001224969396451","102417088336958536661237791077745312979","332766928815090860661876436301382680206","204923748217826683585174340911669928324","217748784823748562789462960041273842837","141838486536023333662484658755018781767","220153607111190258030848993580483389137","151461097413735256047066549769621423259","276204812965403557920909344781926845054","162126202498838470203193371064762120603","33833665756271908604716393422274061475","117562790858737561342304950389387832981","150132404496800494234682555510452664714","192243693333491500882538099033887424134"],"threshold":0.9},"id":"CVE-2026-105111-ba305837","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/Class2HTML.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"function":"writeMethod","file":"src/main/java/org/apache/bcel/util/MethodHTML.java"},"deprecated":false,"digest":{"length":1865,"function_hash":"55328601519474346378269817497251330189"},"id":"CVE-2026-105111-c2d226da","signature_type":"Function"},{"source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/MethodHTML.java","function":"writeField"},"deprecated":false,"digest":{"function_hash":"326763463435560253468034361808780896131","length":998},"id":"CVE-2026-105111-c58c3390","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["203866820074141232392721418387227447593","7666763342247812475413612258738203723","118081033196207647289413064766007913882","142221628666471802938396895651909420508","286376523162716129750727641820629286261","34218736699715163802628254982951283260","96170156681267877429809734869896109565","11279565312462125661080609579014012914","278748797035141246963926197471535465647","136151713364699095650371436300263189164","177192799614865949825105928421878163635","78979736271002659801002331816602552007","182314925989612739855549432483083248602","209277623120944387609627920834029009481"],"threshold":0.9},"id":"CVE-2026-105111-d0e49443","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/ConstantHTML.java"},"deprecated":false},{"signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/Class2HTML.java","function":"toHTML"},"deprecated":false,"digest":{"length":453,"function_hash":"88446034129442143867015411049593817693"},"id":"CVE-2026-105111-e47e97de","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"142638057676887256183678044432269003404","length":4294},"id":"CVE-2026-105111-e78fe0d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/AttributeHTML.java","function":"writeAttribute"}},{"target":{"file":"src/main/java/org/apache/bcel/util/AttributeHTML.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226907598356993166384295375483405615976","274301446251762422415392824580175349052","210831633171073621393554960191410782602","238029531524346651707596438964609001658","226981035551455322130644609679595934425","208476283131738943725747342582302771134","226274668091310747055030864321792227363","180323139516738842111097830446942104586"]},"id":"CVE-2026-105111-eb991e0d","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504"},{"signature_type":"Function","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/AttributeHTML.java","function":"writeAttribute"},"deprecated":false,"digest":{"function_hash":"142638057676887256183678044432269003404","length":4294},"id":"CVE-2026-105111-ef2def88"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["262610257031764994041091045251692759574","171393737718853338107263010907724618207","99756512033697226030295733703638960496","252895594134630429524791317746432731335"]},"id":"CVE-2026-105111-f5720319","signature_type":"Line","signature_version":"v1","source":"https://gitbox.apache.org/repos/asf/commons-bcel.git@fb72c225cbc6ec3d94060ed6edb269f07428d504","target":{"file":"src/main/java/org/apache/bcel/util/CodeHTML.java"}},{"target":{"file":"src/main/java/org/apache/bcel/util/Class2HTML.java","function":"referenceType"},"deprecated":false,"digest":{"length":447,"function_hash":"204705887809301787245737958603979191367"},"id":"CVE-2026-105111-f7cee14a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504"}],"vanir_signatures_modified":"2026-10-09T07:06:22Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105111.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}