CVE-2026-76983
Received Received - Intake

Cross-Site Scripting in Apache Wicket

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Apache Software Foundation

Description
Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no escaping setting at all, so markup in a label is rendered as markup. When the label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. There is no workaround. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped. The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-76983
EUVD
EUVD-2026-68491

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache wicket From 8.0.0 (inc) to 8.18.0 (inc)
apache wicket From 9.0.0 (inc) to 9.23.0 (inc)
apache wicket From 10.0.0 (inc) to 10.10.0 (inc)
apache wicket From 1.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper input handling in Apache Wicket, where labels set via FormComponent#setLabel(IModel) are rendered without escaping. Attackers can inject malicious markup into labels if they control the label data, leading to potential XSS attacks. The issue occurs because the wicket:label tag resolver does not respect escape settings.

Detection Guidance

Check Apache Wicket version with commands like 'mvn dependency:tree | grep wicket-core' or 'find . -name wicket-core*.jar'. Affected versions are 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0, and older unsupported releases from 1.5.0 onwards.

Impact Analysis

An attacker could exploit this to inject and execute malicious scripts in a user's browser when they view a page with a vulnerable label. This could lead to session hijacking, data theft, or defacement. The impact depends on whether the application allows user-controlled label data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Exploitation may result in breaches requiring regulatory reporting and potential fines.

Mitigation Strategies

Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 or later. No workaround exists as the issue stems from default behavior in the AutoLabelTextResolver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart