https://seclists.org/oss-sec/2026/q3/622: CVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributes

Q: Which applications are actually exposed to this issue?

An application is affected only if it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and returns attribute data that an attacker can influence. Applications that do not override these methods are not affected because they return null by default.

Q: What does an attacker need to exploit the issue?

An attacker needs influence over data returned as additional attribute names or values by one of the affected overrides. Those attribute names and values are written into the generated option element without escaping.

Q: What can be done if updating is not immediately possible?

Escape the values in the affected override methods before returning them. This applies to data returned through the additional-attributes methods used by Palette or AbstractOptions.

Q: How can I determine whether my application needs remediation?

Review custom Palette and AbstractOptions implementations for overrides of getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes. Determine whether any returned attribute names or values can contain attacker-influenced data.

Published Aug 31, 2026

Updated

Affected Software

4 affected components

Apache Wicket (wicket-extensions)>=8.0.0<=8.18.0

Apache Wicket (wicket-extensions)>=9.0.0<=9.23.0

Apache Wicket (wicket-extensions)>=10.0.0<=10.10.0

Apache Wicket (wicket-extensions)>=1.4.0<8.0.0

Frequently Asked Questions

Which applications are actually exposed to this issue?

An application is affected only if it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and returns attribute data that an attacker can influence. Applications that do not override these methods are not affected because they return null by default.

What does an attacker need to exploit the issue?

An attacker needs influence over data returned as additional attribute names or values by one of the affected overrides. Those attribute names and values are written into the generated option element without escaping.

What can be done if updating is not immediately possible?

Escape the values in the affected override methods before returning them. This applies to data returned through the additional-attributes methods used by Palette or AbstractOptions.

How can I determine whether my application needs remediation?

Review custom Palette and AbstractOptions implementations for overrides of getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes. Determine whether any returned attribute names or values can contain attacker-influenced data.