CVE-2026-75802
Received Received - Intake

XSS in Apache Wicket Components via Unescaped Model Values

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Apache Software Foundation

Description
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the choice or model data rendered by such a label can inject HTML or script that executes in the browser of any user who views the page. The same value is correctly escaped when the component's dropdown editor renders it as an option, so only the label rendering is affected. AjaxEditableLabel, AjaxEditableChoiceLabel and AjaxEditableMultiLineLabel write the value returned by the protected defaultNullLabel() method into the label's markup the same way when the component's model is empty, while the model value they show otherwise is escaped. The default implementation returns a constant, so an application is affected where it overrides that method and returns a value an attacker can influence. Neither value could be escaped by configuration, because escapeModelStrings had no effect on any of the three components: it is read by the label they render with rather than by the component itself, and nothing carried the setting across. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases are also affected; the display value from the renderer since 6.22.0 and the null label since 1.4.0. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-75802
EUVD
EUVD-2026-68488

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
apache wicket From 8.0.0 (inc) to 8.18.0 (inc)
apache wicket From 9.0.0 (inc) to 9.23.0 (inc)
apache wicket From 10.0.0 (inc) to 10.10.0 (inc)
apache wicket From 6.22.0 (inc)
apache wicket From 1.4.0 (inc)
apache wicket 8.19.0
apache wicket 9.24.0
apache wicket 10.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache Wicket's AjaxEditableChoiceLabel and related components. When these components use a non-null IChoiceRenderer, they fail to escape HTML from user-controlled data in the label's markup. This allows attackers to inject malicious scripts that execute in the browsers of users viewing the page. The issue occurs because the components do not apply Wicket's default HTML escaping to certain rendered values.

Detection Guidance

This vulnerability affects Apache Wicket versions 6.22.0 through 10.10.0. To detect it, check your Wicket library version in your project dependencies or classpath. Look for AjaxEditableChoiceLabel, AjaxEditableLabel, or AjaxEditableMultiLineLabel components in your application code.

Impact Analysis

If you use an affected version of Apache Wicket, an attacker could exploit this to run malicious scripts in your browser when you view a page with these components. This could lead to theft of session cookies, account takeover, or other client-side attacks. The impact depends on whether you use the vulnerable components with user-controlled data.

Compliance Impact

This vulnerability allows attackers to inject malicious scripts into web pages via XSS, which could lead to unauthorized data access or manipulation. This may violate GDPR's requirement for protecting user data and HIPAA's safeguards for protected health information if exploited in healthcare applications.

Mitigation Strategies

Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 or later. These versions fix the issue. If upgrading is not immediately possible, review all uses of the affected components and ensure any user-controlled data passed to them is properly escaped before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart