CVE-2026-76984 Overview
CVE-2026-76984 is a cross-site scripting (XSS) vulnerability in Apache Wicket [CWE-79]. The flaw resides in org.apache.wicket.markup.head.MetaDataHeaderItem, which generates <meta> and <link> header tags. Attribute values are escaped by replacing " with \", but a backslash before a double quote has no meaning in HTML. A value containing a double quote closes its own attribute, and subsequent content is parsed as additional tag attributes. Applications that pass attacker-influenced data through addTagAttribute, forMetaTag, or forLinkTag are affected.
Critical Impact
An attacker who controls attribute values written into <meta> or <link> header tags can inject arbitrary HTML attributes, enabling script execution in the victim's browser.
Affected Products
- Apache Wicket 8.0.0 through 8.18.0
- Apache Wicket 9.0.0 through 9.23.0
- Apache Wicket 10.0.0 through 10.10.0 (older unsupported releases from 6.17.0 onwards are also affected)
Discovery Timeline
- 2026-08-31 - CVE-2026-76984 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-76984
Vulnerability Analysis
Apache Wicket generates HTML header tags through MetaDataHeaderItem, which writes attribute name and value pairs into <meta> and <link> elements. The framework escapes attribute names correctly, but attempts to neutralize double quotes in attribute values by prefixing them with a backslash. HTML parsing does not recognize backslash as an escape character. A double quote in the value therefore terminates the attribute, and any subsequent characters are treated as additional tag attributes by the browser.
An attacker who influences the value passed to addTagAttribute or supplied via the forMetaTag and forLinkTag factory methods can inject event handlers such as onload or onerror. Because values may be provided as an IModel, they need not be literals, and dynamic data from user input, databases, or upstream services can reach the vulnerable sink. Prior to the fixes released in 6.24.0, 7.4.0, and 8.0.0, these values were written with no escaping at all, so the current backslash substitution replaced one broken behavior with another.
Root Cause
The root cause is improper output neutralization during web page generation. The escaping logic uses a scheme (\") that HTML parsers do not honor, producing markup that reflects an attacker-supplied double quote unaltered into the tag context.
Attack Vector
Exploitation requires an authenticated user with low privileges and passive user interaction, such as loading a page rendered by the Wicket application. The attacker submits a payload containing a double quote followed by injected attributes into any field whose value flows into a header tag attribute. When the page renders, the browser parses the injected attributes and executes the attacker's JavaScript. See the Apache Mailing List Thread for the full advisory.
Detection Methods for CVE-2026-76984
Indicators of Compromise
- Rendered HTML containing <meta> or <link> tags with unexpected event handler attributes such as onload=, onerror=, or onmouseover=.
- Application logs showing user-controlled input containing raw " characters being passed to MetaDataHeaderItem factory methods.
- Web server access logs with anomalous requests targeting endpoints that reflect data into header metadata.
Detection Strategies
- Perform static analysis on Wicket codebases to locate calls to addTagAttribute, forMetaTag, and forLinkTag and audit whether the supplied values originate from untrusted input.
- Configure a web application firewall (WAF) to flag request parameters containing double quote characters destined for endpoints that render header metadata.
- Inspect responses in staging environments for malformed <meta> or <link> tags produced by fuzzed inputs containing " sequences.
Monitoring Recommendations
- Monitor Content Security Policy (CSP) violation reports for inline script execution originating from application pages.
- Track dependency inventories for Apache Wicket versions in the affected ranges (8.0.0–8.18.0, 9.0.0–9.23.0, 10.0.0–10.10.0).
- Alert on outbound requests from user browsers to unexpected domains following interaction with Wicket-rendered pages.
How to Mitigate CVE-2026-76984
Immediate Actions Required
- Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0, which fix the improper escaping in MetaDataHeaderItem.
- Audit application code for use of addTagAttribute, forMetaTag, and forLinkTag, and reject or sanitize input values containing double quote characters.
- Deploy a strict Content Security Policy to limit the impact of successful HTML attribute injection.
Patch Information
The Apache Wicket project has released fixed versions 8.19.0, 9.24.0, and 10.11.0. Details are published in the Apache Mailing List Thread and the OpenWall OSS-Security Notice. No configuration setting mitigates the flaw; upgrading is required.
Workarounds
- Ensure attribute values passed to header tag builders never contain a double quote by validating and stripping the character upstream.
- Where user-controlled data must appear in metadata, encode it server-side using a proven HTML attribute encoder before handing it to Wicket.
- Restrict privileges required to submit content that reaches header metadata rendering paths until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
