What is GHSA-vpf7-2j6x-pp68?

GHSA-vpf7-2j6x-pp68 is a security advisory published by GitHub Security Advisories with Low severity. Improper neutralization of input during web page generation ('cross-site scripting')...

Which CVE IDs does GHSA-vpf7-2j6x-pp68 cover?

GHSA-vpf7-2j6x-pp68 covers the following CVE IDs: CVE-2026-105111. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vpf7-2j6x-pp68?

GHSA-vpf7-2j6x-pp68 has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

GHSA-vpf7-2j6x-pp68LowCVSS 4.7

Improper neutralization of input during web page generation ('cross-site scripting')...

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-105111 →

📋 Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.

This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).

This issue affects Apache Commons BCEL: before 6.13.0.

Users are recommended to upgrade to version 6.13.0, which fixes the issue.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-105111
https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch
https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6
http://www.openwall.com/lists/oss-security/2026/10/07/13
https://github.com/advisories/GHSA-vpf7-2j6x-pp68