CVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributes
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came.
An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected.
As a workaround, escape the values in the override.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 8.19.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 9.24.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 10.11.0 - Configuration
As a workaround, escape the values in the overrides of Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes so attacker-influenced data cannot be written into the <option> attribute names/values.
org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions escape-model-strings = (existing setting; ensure values returned by getAdditionalAttributes are escaped)
Event History
Frequently Asked Questions
Which applications are actually exposed to this issue?
An application is affected only if it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and returns attribute names or values containing attacker-influenced data. Applications that do not override these methods are not affected because they return null by default.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to influence data returned as an additional attribute name or value by one of the affected override methods. The vulnerable rendering path writes those attributes into Palette option tags without escaping them.
What can be done if an upgrade cannot happen immediately?
Escape the values returned by the relevant override before they are written as option attributes. Review all overrides of the three affected methods for attribute data derived from requests, users, database content, or other untrusted sources.
Which fixed versions are available?
Upgrade to Apache Wicket 8.19.0, 9.24.0, or 10.11.0. Affected supported ranges are 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0; unsupported releases from 1.4.0 onward are also affected.