CVE-2026-76982: Apache Wicket: XSS in Button via its model object

Published Aug 31, 2026
·
Updated

Improper neutralization of input during web page generation in Apache Wicket.

org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a <button> element rather than an <input>, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.

An application is affected where it renders a Button on a <button> element and that button's model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor — AjaxButton, AjaxFallbackButton and WizardButton — are affected on the same terms.

As a workaround, calling setEscapeModelStrings(true) on a button that renders as a <button> element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for <input> elements.

This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.

Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

Affected Software

1 affected component
Apache wicket>=8.0.0<=8.18.0, >=9.0.0<=9.23.0, >=10.0.0<=10.10.0, >=6.25.0<=, >=7.5.0<=

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Apache Wicket to a version that resolves this vulnerability.

    Fixed in 8.19.0
  2. Upgrade

    Upgrade Apache Wicket to a version that resolves this vulnerability.

    Fixed in 9.24.0
  3. Upgrade

    Upgrade Apache Wicket to a version that resolves this vulnerability.

    Fixed in 10.11.0
  4. Configuration

    As a workaround, call setEscapeModelStrings(true) on the affected button (that renders as a <button> element) so the button's model object is escaped correctly in the element body without double encoding.

    Apache Wicket Button setEscapeModelStrings(true) = true
  5. Compensating control

    Ensure any user-influenced data placed in the model object rendered inside a <button> element is treated as untrusted until escaping (via setEscapeModelStrings(true)) is applied or Wicket is upgraded.

Event History

Aug 31, 2026
CVE Published
via MITRE·11:52 AM
Data Sourced
via MITRE·11:52 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which applications are exposed to this issue?

An application is affected only when it renders a Button, AjaxButton, AjaxFallbackButton, or WizardButton as a <button> element and the button model contains attacker-influenced data. The attacker-controlled value may originate from a request or from stored data; that depends on the application.

2

What must an attacker control to exploit this?

An attacker must be able to influence the model object used by an affected button. Markup in that model is rendered into the <button> element body as markup rather than being encoded.

3

Is rendering the component as an <input> affected?

The described issue occurs when the component is attached to a <button> element. For an attribute value, ComponentTag encodes the value when writing the tag, which is why the constructor's escape setting was intended for that case.

4

What can be done if patching is not immediately possible?

Call setEscapeModelStrings(true) on each affected button that renders as a <button> element. This escapes the element body correctly and does not cause double encoding because the value attribute is written only for the other rendering case.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203