CVE-2026-76986: Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every other option body in the same select is escaped according to the escape-model-strings setting. The body comes from getNullValidDisplayValue() or getNullKeyDisplayValue(), both of which are protected, so what they return is not necessarily the plain text the default implementation reads from a resource bundle.
An application is affected where it overrides one of those methods and returns a value holding data an attacker can influence, or where its own nullValid or null bundle entry holds such a value. The bundles shipped with Wicket contain plain text. RadioChoice overrides getDefaultChoice to emit no default option and is not affected.
As a workaround, escape the value in the override.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 8.19.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 9.24.0 - Upgrade
Upgrade
Apache Wicketto a version that resolves this vulnerability.Fixed in 10.11.0 - Configuration
If you implement/override methods that influence the value returned for the default option (e.g., getNullValidDisplayValue / getNullKeyDisplayValue), apply escaping to the returned value in the override as the workaround.
Apache Wicket org.apache.wicket.markup.html.form.AbstractSingleSelectChoice escape-model-strings = (escapes all non-default option bodies; default option body is written unescaped)
Event History
Frequently Asked Questions
Which applications are actually exposed to this issue?
An application is affected if it overrides getNullValidDisplayValue() or getNullKeyDisplayValue() and returns attacker-influenced data, or if its own nullValid or null resource-bundle entry can contain attacker-influenced data. Wicket's shipped resource bundles contain plain text, so they are not affected on that basis alone.
Are all Wicket choice components affected?
No. The issue concerns AbstractSingleSelectChoice and therefore components such as DropDownChoice that use its default-option rendering. RadioChoice is not affected because it overrides getDefaultChoice() and emits no default option.
Which Wicket versions are affected?
Affected supported versions are 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Older unsupported releases from 1.5.0 onward are also affected.
What can be done if patching is not immediately possible?
Escape the value returned by the application's override of getNullValidDisplayValue() or getNullKeyDisplayValue(). Also ensure that application-controlled nullValid and null bundle values cannot contain untrusted markup.