Apache Commons BCEL’s Class2HTML generator includes class file data into HTML without proper escaping, creating a stored cross‑site scripting flaw. An attacker who can supply a crafted class file that is by Class2HTML will cause malicious JavaScript or markup to be embedded in the resulting web page report, potentially compromising any user who views the report. This weakness is identified as CWE‑79.

The vulnerability exists in Apache Commons BCEL versions prior to 6.13.0, distributed by the Apache Software Foundation. Systems that incorporate any of those pre‑6.13.0 releases and use the Class2HTML tool to produce web pages—for example, debugging or monitoring dashboards that display class structures—are affected. Updated versions starting with 6.13.0 contain the necessary escaping fix.

The CVSS score of 2.3 indicates a low‑severity risk, and no EPSS score is available, suggesting limited exploitation data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a web interface that allows processing of attacker‑controlled class files through Class2HTML, creating an HTML report that contains unescaped class strings; an attacker must supply such a file and have the resulting report rendered for a target user. Any user viewing the report could have malicious script executed in their browser, but the overall impact remains low.