https://seclists.org/oss-sec/2026/q3/618: CVE-2026-75802: Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoicender and defaultNullLabel

Q: What control must an attacker have to trigger the issue?

The attacker must be able to influence the choice or model data that is rendered by the affected label. The supplied information does not state whether authentication is required to obtain that influence.

Q: Is the dropdown editor's option rendering affected too?

No. The display value is correctly HTML-escaped when the dropdown editor renders it as an option; the affected rendering path is the label.

Q: Which component usage should be prioritized for review?

Prioritize AjaxEditableChoiceLabel instances constructed with a non-null IChoiceRenderer, especially where choice or model display data can contain attacker-controlled content. The affected artifact is wicket-extensions in versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.

Published Aug 31, 2026

Updated

Affected Software

3 affected components

Apache Wicket (wicket-extensions)>=8.0.0<=8.18.0

Apache Wicket (wicket-extensions)>=9.0.0<=9.23.0

Apache Wicket (wicket-extensions)>=10.0.0<=10.10.0

Frequently Asked Questions

What control must an attacker have to trigger the issue?

The attacker must be able to influence the choice or model data that is rendered by the affected label. The supplied information does not state whether authentication is required to obtain that influence.

Is the dropdown editor's option rendering affected too?

No. The display value is correctly HTML-escaped when the dropdown editor renders it as an option; the affected rendering path is the label.

Which component usage should be prioritized for review?

Prioritize AjaxEditableChoiceLabel instances constructed with a non-null IChoiceRenderer, especially where choice or model display data can contain attacker-controlled content. The affected artifact is wicket-extensions in versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.