CVE-2026-42509: Apache Wicket: crafted strings can break out of the JavaScript sequence
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.
Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42509?
CVE-2026-42509 is rated as a high-severity vulnerability due to its Cross-site Scripting (XSS) risk.
How do I fix CVE-2026-42509?
To fix CVE-2026-42509, upgrade Apache Wicket to version 8.18.0 or higher, or version 9.1.0 or higher, or to version 10.9.0 or higher.
Which versions of Apache Wicket are affected by CVE-2026-42509?
CVE-2026-42509 affects Apache Wicket versions from 8.0.0 through 8.17.0, exactly 9.0.0, and 10.0.0 through 10.8.0.
What type of vulnerability is CVE-2026-42509?
CVE-2026-42509 is classified as an Improper Neutralization of Input During Web Page Generation, leading to Cross-site Scripting.
Can I manually mitigate CVE-2026-42509 without an upgrade?
Manual mitigation strategies for CVE-2026-42509 should involve sanitizing user inputs in JavaScript contexts to prevent XSS attacks.