https://seclists.org/oss-sec/2026/q3/621: CVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Q: Which applications are exposed to this issue?

An application is affected only if it uses MetaDataHeaderItem to supply an attacker-influenced attribute value through addTagAttribute or the forMetaTag or forLinkTag factory methods. The affected value may come from an IModel and does not have to be a literal string.

Q: What input is needed to exploit the issue?

The attacker must be able to influence an attribute value that is written into a generated meta or link tag, including causing that value to contain a double quote. The quote can terminate the intended HTML attribute and cause subsequent input to be parsed as additional tag attributes.

Q: Is there a configuration setting that mitigates the problem?

No. There is no setting to change; applications must avoid supplying attribute values containing double quotes when immediate remediation is needed.

Published Aug 31, 2026

Updated

Affected Software

3 affected components

Apache wicket>=8.0.0<=8.18.0

Apache wicket>=9.0.0<=9.23.0

Apache wicket>=10.0.0<=10.10.0

Frequently Asked Questions

Which applications are exposed to this issue?

An application is affected only if it uses MetaDataHeaderItem to supply an attacker-influenced attribute value through addTagAttribute or the forMetaTag or forLinkTag factory methods. The affected value may come from an IModel and does not have to be a literal string.

What input is needed to exploit the issue?

The attacker must be able to influence an attribute value that is written into a generated meta or link tag, including causing that value to contain a double quote. The quote can terminate the intended HTML attribute and cause subsequent input to be parsed as additional tag attributes.

Is there a configuration setting that mitigates the problem?

No. There is no setting to change; applications must avoid supplying attribute values containing double quotes when immediate remediation is needed.