https://seclists.org/oss-sec/2026/q3/623: CVE-2026-76986: Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
Affected Software
Frequently Asked Questions
Which applications are actually exposed to this issue?
An application is affected if it overrides getNullValidDisplayValue() or getNullKeyDisplayValue() and returns attacker-influenced data, or if its own nullValid or null resource-bundle entry contains attacker-influenced content. The resource bundles shipped with Wicket contain plain text.
What must an attacker control to exploit it?
The attacker must be able to influence the value used as the display body for the unselected default option of an AbstractSingleSelectChoice-derived component. That value is written into generated markup without the escaping applied to other option bodies.
Are RadioChoice components affected?
No. RadioChoice overrides getDefaultChoice() so that it emits no default option.
What code and configuration should be reviewed while remediation is pending?
Review subclasses of AbstractSingleSelectChoice, including DropDownChoice, for overrides of getNullValidDisplayValue() or getNullKeyDisplayValue(). Also inspect application-controlled nullValid and null resource-bundle entries and ensure they cannot contain attacker-controlled markup.