https://seclists.org/oss-sec/2026/q3/620: CVE-2026-76983: Apache Wicket: XSS in AutoLabelTextsolver via FormComponent.setLabel

Q: Which applications are actually exposed to this issue?

An application is affected if it uses the default-registered wicket:label resolver and a form component’s label model, set through FormComponent#setLabel(IModel), can contain attacker-influenced data. The attacker-controlled value may originate from a request or from stored data; that depends on the application.

Q: Does disabling model-string escaping prevent exploitation?

No. AutoLabelTextResolver does not consult the escape-model-strings setting and writes the label into markup unescaped.

Q: Is there a configuration-based workaround if upgrading cannot happen immediately?

No workaround is provided. The issue occurs because the resolver renders the label value as markup without escaping.

Published Aug 31, 2026

Updated

Affected Software

1 affected component

Apache wicket>=8.0.0<=8.18.0, >=9.0.0<=9.23.0, >=10.0.0<=10.10.0

Frequently Asked Questions

Which applications are actually exposed to this issue?

An application is affected if it uses the default-registered wicket:label resolver and a form component’s label model, set through FormComponent#setLabel(IModel), can contain attacker-influenced data. The attacker-controlled value may originate from a request or from stored data; that depends on the application.

Does disabling model-string escaping prevent exploitation?

No. AutoLabelTextResolver does not consult the escape-model-strings setting and writes the label into markup unescaped.

Is there a configuration-based workaround if upgrading cannot happen immediately?

No workaround is provided. The issue occurs because the resolver renders the label value as markup without escaping.