CVE-2026-76983 Overview
CVE-2026-76983 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Wicket [CWE-79]. The flaw resides in org.apache.wicket.markup.html.form.AutoLabelTextResolver, which handles the <wicket:label> tag registered by default in every WebApplication. The resolver writes label values into markup without consulting the escape-model-strings setting, so any HTML or script present in a label renders as markup.
When a form component's label is set through FormComponent#setLabel(IModel) and that model carries attacker-influenced data, the payload reaches the rendered page unescaped. Applications using labels sourced from user input, database records, or request parameters are affected.
Critical Impact
Attackers with the ability to influence label model values can inject arbitrary HTML or JavaScript into rendered pages, enabling session theft, credential harvesting, and client-side attacks against authenticated users.
Affected Products
- Apache Wicket 8.0.0 through 8.18.0
- Apache Wicket 9.0.0 through 9.23.0
- Apache Wicket 10.0.0 through 10.10.0 (unsupported releases from 1.5.0 onwards are also affected)
Discovery Timeline
- 2026-08-31 - CVE-2026-76983 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-76983
Vulnerability Analysis
Apache Wicket renders labels through the AutoLabelTextResolver, invoked whenever a <wicket:label> tag appears in markup. Every other rendering path in Wicket consults the escape-model-strings framework setting to determine whether output should be HTML-escaped. The AutoLabelTextResolver skips that check and writes the label value directly into the response stream.
The body of a <wicket:label> tag is intentionally treated as markup and remains the supported way to embed rich content. The vulnerability specifically concerns label values supplied through FormComponent#setLabel(IModel), where the framework silently trusts the model output. Applications cannot opt into escaping because the resolver never queries the setting.
Root Cause
The defect is a missing output encoding step [CWE-79]. AutoLabelTextResolver was implemented without honoring the framework-wide escape-model-strings flag, breaking Wicket's uniform contract for model rendering. Because Wicket cannot infer the provenance of a model value, it cannot automatically classify labels as trusted or untrusted, and the resolver defaulted to unsafe behavior.
Attack Vector
Exploitation requires an authenticated attacker who can persist or reflect data into a value later consumed by FormComponent#setLabel(IModel). A common pattern is a profile or configuration field whose value is later shown as a form label to another user. When the target loads the page, the injected markup executes in the victim's browser under the application's origin.
User interaction is required for the payload to trigger, and no workaround exists at the application layer. Any manipulation of the label model — including HTML tags, <script> blocks, or event-handler attributes — reaches the DOM verbatim.
Detection Methods for CVE-2026-76983
Indicators of Compromise
- Rendered HTML responses containing unexpected <script>, <img onerror=>, or <svg> fragments inside <label> elements produced by Wicket forms.
- Web server access logs showing POST or PUT requests to profile, settings, or administration endpoints with HTML-encoded payloads in fields that later populate form labels.
- Session anomalies such as cookie exfiltration attempts or unexpected outbound requests from authenticated user browsers to attacker-controlled domains.
Detection Strategies
- Perform static analysis of the codebase for calls to FormComponent#setLabel(IModel) and setLabel(new Model<>(...)) where the model source can be traced back to user input or persisted data.
- Deploy Web Application Firewall (WAF) rules that flag HTML tags and JavaScript event handlers in form submissions targeting fields backing label models.
- Review runtime HTML output during QA and staging for markup rendered inside <label> tags emitted by Wicket's AutoLabelTextResolver.
Monitoring Recommendations
- Monitor Content Security Policy (CSP) violation reports for inline script or unsafe-eval violations originating from Wicket-rendered pages.
- Alert on outbound HTTP requests from user sessions to unknown domains shortly after visiting form-heavy pages.
- Track Apache Wicket version metadata across deployments to identify systems still running vulnerable 8.x, 9.x, or 10.x releases.
How to Mitigate CVE-2026-76983
Immediate Actions Required
- Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0, which contain the fix.
- Audit application code for every invocation of FormComponent#setLabel(IModel) and confirm the label source is trusted or explicitly HTML-escaped by the developer.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of any residual injection paths.
Patch Information
The Apache Wicket project released fixed versions 8.19.0, 9.24.0, and 10.11.0. Review the Apache Mailing List Discussion and the Openwall OSS Security Update for the official advisory and release notes.
Workarounds
- No framework-level workaround exists because AutoLabelTextResolver never consulted the escape-model-strings setting in vulnerable versions.
- Pre-encode label values in application code using Strings.escapeMarkup() before passing them to FormComponent#setLabel(IModel).
- Restrict input at persistence and API boundaries so label-bound fields cannot contain HTML metacharacters.
# Maven dependency update example
mvn versions:set-property -Dproperty=wicket.version -DnewVersion=10.11.0
mvn clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
