CVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with \". A backslash before a double quote means nothing in HTML, so a value containing a double quote ends its own attribute and what follows is parsed as further attributes of the generated tag.
An application is affected where it supplies an attribute value holding data an attacker can influence, through addTagAttribute or the forMetaTag and forLinkTag factory methods. A value may be given as an IModel, so it is not necessarily a literal.
There is no setting to change; an application can only avoid supplying a value that contains a double quote. Note that these values have never been escaped effectively: before the change released in 6.24.0, 7.4.0 and 8.0.0 they were written with no escaping at all.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.17.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 8.19.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 9.24.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 10.11.0 - Compensating control
Avoid supplying attacker-influenced attribute values to Apache Wicket MetaDataHeaderItem (e.g., via addTagAttribute, or the forMetaTag and forLinkTag factory methods) when those values contain a double quote (").
Event History
Frequently Asked Questions
Which applications are realistically exposed?
An application is affected only if it supplies an attacker-influenced attribute value through addTagAttribute or the forMetaTag and forLinkTag factory methods. Values supplied through an IModel also require review because they may not be literals.
What must an attacker control to exploit this issue?
The attacker needs to influence an attribute value used to generate a meta or link header tag and include a double quote in that value. The quote can terminate the intended HTML attribute, causing subsequent content to be parsed as additional attributes.
Is there a configuration change that mitigates the issue?
No. There is no setting to change; the application must avoid supplying attribute values containing double quotes until it can be upgraded.
How can teams identify potentially affected code?
Audit uses of addTagAttribute, forMetaTag, and forLinkTag, including values obtained through IModel. Prioritize call paths where request data, database content, or other attacker-controllable input can reach an attribute value.
Which release lines are identified as affected?
Affected releases are Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Unsupported releases from 6.17.0 onward are also affected.