CVE-2026-76984
Received Received - Intake

XSS in Apache Wicket via Unescaped Attribute Values

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Apache Software Foundation

Description
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with \". A backslash before a double quote means nothing in HTML, so a value containing a double quote ends its own attribute and what follows is parsed as further attributes of the generated tag. An application is affected where it supplies an attribute value holding data an attacker can influence, through addTagAttribute or the forMetaTag and forLinkTag factory methods. A value may be given as an IModel, so it is not necessarily a literal. There is no setting to change; an application can only avoid supplying a value that contains a double quote. Note that these values have never been escaped effectively: before the change released in 6.24.0, 7.4.0 and 8.0.0 they were written with no escaping at all. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.17.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-76984
EUVD
EUVD-2026-68490

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache wicket From 8.0.0 (inc) to 8.18.0 (inc)
apache wicket From 9.0.0 (inc) to 9.23.0 (inc)
apache wicket From 10.0.0 (inc) to 10.10.0 (inc)
apache wicket From 6.17.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper input handling in Apache Wicket where attribute values containing double quotes are not properly neutralized. The system escapes attribute names but incorrectly processes attribute values by replacing double quotes with backslash-escaped quotes. Since HTML ignores backslashes before quotes, attackers can inject malicious attributes by including double quotes in input data.

Detection Guidance

Check Apache Wicket version in use. Affected versions are 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0, and older unsupported releases from 6.17.0. Use commands like 'find / -name wicket*.jar' or check dependency files (pom.xml, build.gradle) for version numbers.

Impact Analysis

An attacker could manipulate input data to inject additional attributes into HTML meta or link tags generated by the application. This could lead to unintended behavior, such as redirecting users to malicious sites, stealing session cookies, or altering page content. Applications using affected Wicket versions are vulnerable if they pass user-controlled data to tag attributes.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. If exploited, it may result in data breaches, triggering compliance obligations under these regulations.

Mitigation Strategies

Upgrade Apache Wicket to fixed versions: 8.19.0, 9.24.0, or 10.11.0. Avoid supplying attribute values containing double quotes in affected methods like addTagAttribute or factory methods forMetaTag and forLinkTag.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart