CVE-2026-76985
Received Received - Intake

XSS in Apache Wicket due to improper input neutralization

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Apache Software Foundation

Description
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came. An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected. As a workaround, escape the values in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-76985
EUVD
EUVD-2026-68516

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache wicket From 8.0.0 (inc) to 8.18.0 (inc)
apache wicket From 9.0.0 (inc) to 9.23.0 (inc)
apache wicket From 10.0.0 (inc) to 10.10.0 (inc)
apache wicket From 1.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper input neutralization issue in Apache Wicket. It occurs when the application overrides methods like Palette.getAdditionalAttributesForChoices and returns attacker-controlled data. The data is not properly escaped and is written directly into HTML option tags, potentially leading to XSS attacks.

Detection Guidance

Check Apache Wicket versions between 8.0.0-8.18.0, 9.0.0-9.23.0, or 10.0.0-10.10.0. Inspect custom implementations of Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes for unescaped user-controlled data.

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages, leading to unauthorized actions, data theft, or session hijacking. Only applications that override specific methods are affected.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling cross-site scripting (XSS) attacks if user-influenced data is improperly rendered in web pages. XSS attacks may lead to unauthorized data access or manipulation, violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0. If upgrading is not possible, escape all values returned by overridden methods like getAdditionalAttributes to neutralize attacker-controlled input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart