CVE-2026-84231

Received Received - Intake

XSS in Apache Wicket ExternalLink Component

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Apache Software Foundation

Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element. This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-01

Last Modified

2026-11-01

Generated

2026-11-02

AI Q&A

2026-11-02

EPSS Evaluated

N/A

NVD

CVE-2026-84231

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Wicket	8.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper input handling in Apache Wicket, where JavaScript code can be injected via an ExternalLink component. When the component is bound to non-anchor tags like buttons or spans, the URL from the model is concatenated into a JavaScript string without proper escaping. This allows an attacker to close the string literal and execute arbitrary script in the application's context when a user interacts with the element.

Detection Guidance

This vulnerability affects Apache Wicket versions 8.0.0 through 8.19.0. To detect it, check the installed version of Apache Wicket on your system using commands like 'find / -name wicket-core*.jar' or 'mvn dependency:tree | grep wicket-core' in your project directory. If the version falls within the affected range, the system is potentially vulnerable.

Impact Analysis

If your application uses Apache Wicket versions 8.0.0 through 8.19.0 and binds ExternalLink to non-anchor tags with user-influenced URLs, attackers could execute malicious scripts in your application. This could lead to data theft, session hijacking, or defacement. Users must interact with the affected element for the attack to succeed.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if user data is exposed or altered due to the script execution.

Mitigation Strategies

Upgrade Apache Wicket to version 8.20.0 or later immediately. This version fixes the issue. If you are using an unsupported version (7.x or older), upgrade to a supported version as soon as possible.

Hi! I’m here to help you understand CVE-2026-84231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...