CVE-2026-76982: Apache Wicket: XSS in Button via its model object
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a <button> element rather than an <input>, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.
An application is affected where it renders a Button on a <button> element and that button's model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor — AjaxButton, AjaxFallbackButton and WizardButton — are affected on the same terms.
As a workaround, calling setEscapeModelStrings(true) on a button that renders as a <button> element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for <input> elements.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.
Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 8.19.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 9.24.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 10.11.0 - Configuration
As a workaround, call setEscapeModelStrings(true) on the affected button (that renders as a <button> element) so the button's model object is escaped correctly in the element body without double encoding.
Apache Wicket Button setEscapeModelStrings(true) = true - Compensating control
Ensure any user-influenced data placed in the model object rendered inside a <button> element is treated as untrusted until escaping (via setEscapeModelStrings(true)) is applied or Wicket is upgraded.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
An application is affected only when it renders a Button, AjaxButton, AjaxFallbackButton, or WizardButton as a <button> element and the button model contains attacker-influenced data. The attacker-controlled value may originate from a request or from stored data; that depends on the application.
What must an attacker control to exploit this?
An attacker must be able to influence the model object used by an affected button. Markup in that model is rendered into the <button> element body as markup rather than being encoded.
Is rendering the component as an <input> affected?
The described issue occurs when the component is attached to a <button> element. For an attribute value, ComponentTag encodes the value when writing the tag, which is why the constructor's escape setting was intended for that case.
What can be done if patching is not immediately possible?
Call setEscapeModelStrings(true) on each affected button that renders as a <button> element. This escapes the element body correctly and does not cause double encoding because the value attribute is written only for the other rendering case.