CVE-2026-76982: Apache Wicket XSS Vulnerability

CVE-2026-76982 Overview

CVE-2026-76982 is a cross-site scripting (XSS) vulnerability in Apache Wicket [CWE-79]. The flaw resides in org.apache.wicket.markup.html.form.Button, whose constructor clears the escape-model-strings flag. When the component is attached to a <button> element instead of an <input> element, Wicket writes the model object into the element body without encoding it. Attacker-influenced model data is rendered as raw markup, enabling script execution in the victim's browser.

The subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the constructor and share the same defect.

Critical Impact

Applications rendering a Wicket Button on a <button> element with attacker-influenced model data allow arbitrary HTML and JavaScript to execute in the browser session of any user viewing the page.

Affected Products

• Apache Wicket 8.0.0 through 8.18.0
• Apache Wicket 9.0.0 through 9.23.0
• Apache Wicket 10.0.0 through 10.10.0 (older unsupported releases from 6.25.0 and 7.5.0 onwards are also affected)

Discovery Timeline

• 2026-08-31 - CVE-2026-76982 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-76982

Vulnerability Analysis

Apache Wicket is a component-based Java web framework that renders HTML by binding server-side components to markup elements. The Button component supports two markup targets: the traditional <input type="submit"> element and the HTML <button> element. These targets require different rendering paths because <input> carries its label in the value attribute while <button> carries it in the element body.

To avoid double-encoding the value attribute — since ComponentTag already encodes attribute values — the Button constructor calls setEscapeModelStrings(false). That decision is correct for the attribute path but wrong for the body path. When the component renders into a <button> element, Wicket writes the model object directly into the element body, and nothing else in the render pipeline HTML-encodes body content.

Any model value influenced by an attacker — whether from a request parameter, persisted database record, or upstream storage — is emitted verbatim. Injected markup such as <script> tags executes in the user's browser under the application's origin.

Root Cause

The root cause is an incorrect assumption in the Button constructor. Clearing escapeModelStrings was intended to prevent double encoding of the value attribute, but the framework applies the flag globally across both rendering paths. The <button> body rendering path has no compensating encoder, so the disabled flag causes raw output.

Attack Vector

Exploitation requires an application that renders a Wicket Button, AjaxButton, AjaxFallbackButton, or WizardButton on a <button> element with a model bound to attacker-controllable data. The attacker supplies HTML or JavaScript through any input channel that reaches the button model. When a victim loads the page, the browser parses the injected markup and executes the script in the application's security context. User interaction is required to load or trigger the affected page.

No verified public exploit code is available. See the Apache Mailing List Discussion and the Openwall OSS Security Post for the vendor's technical description.

Detection Methods for CVE-2026-76982

Indicators of Compromise

• HTTP responses containing unencoded <script>, <img onerror=>, or other active markup inside <button> elements rendered by Wicket pages.
• Application log entries showing unexpected characters such as <, >, or " reaching form-button model bindings.
• Browser console errors or Content Security Policy violations originating from Wicket-rendered <button> bodies.

Detection Strategies

• Perform static analysis on Wicket source to identify Button, AjaxButton, AjaxFallbackButton, and WizardButton instances whose HTML template uses a <button> tag with a wicket:id.
• Trace model bindings for affected buttons back to request parameters, database fields, or third-party data to determine attacker reachability.
• Use dependency scanning tools to flag org.apache.wicket:wicket-core versions in the affected ranges.

Monitoring Recommendations

• Instrument web application firewalls to alert on HTML-encoded payloads targeting form submission endpoints backed by Wicket pages.
• Monitor CSP violation reports for inline script executions on pages that render Wicket buttons.
• Correlate outbound requests from user browsers with recently modified button model data sources.

How to Mitigate CVE-2026-76982

Immediate Actions Required

• Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0, which contain the fix.
• Audit application markup for <button wicket:id="..."> usages and identify buttons whose model data can be influenced by external input.
• Apply the setEscapeModelStrings(true) workaround on affected buttons until the upgrade is deployed.

Patch Information

The Apache Wicket project has released fixed versions 8.19.0, 9.24.0, and 10.11.0. Refer to the Apache Mailing List Discussion for release details and the associated commits.

Workarounds

• Call setEscapeModelStrings(true) on every Button instance rendered as a <button> element. This escapes the body correctly and does not cause double encoding, because the value attribute is written only for <input> elements.
• Replace <button> markup with <input type="submit"> where the button label is derived from untrusted data.
• Sanitize or reject HTML metacharacters in any data source that feeds a button model.

# Example: enforce body escaping on an affected button in Java
# Add to the component construction in your Wicket page or panel
#
#   Button submit = new Button("submit", Model.of(labelFromUntrustedSource));
#   submit.setEscapeModelStrings(true);
#   add(submit);