CVE-2026-76985: Apache Wicket XSS Vulnerability

CVE-2026-76985 Overview

CVE-2026-76985 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in Apache Wicket, a Java-based component-oriented web framework. The flaw resides in org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette component. While the option id and display value are escaped according to the escape-model-strings setting, attribute names and values returned by getAdditionalAttributes are written directly into the <option> tag without neutralization.

Applications become vulnerable only when they override Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and return attacker-influenced data. The default null return value is safe.

Critical Impact
Attackers can inject arbitrary HTML attributes and JavaScript into rendered <option> elements, enabling script execution in the context of the victim's authenticated session.

Affected Products

Apache Wicket 8.0.0 through 8.18.0
Apache Wicket 9.0.0 through 9.23.0
Apache Wicket 10.0.0 through 10.10.0 (older unsupported releases from 1.4.0 onwards are also affected)

Discovery Timeline

2026-08-31 - CVE-2026-76985 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-76985

Vulnerability Analysis

The vulnerability is a classic improper neutralization of input during web page generation, categorized under CWE-79. Apache Wicket's Palette component renders two paired option lists used to build multi-select choice interfaces. Each entry becomes an HTML <option> element.

The rendering path in AbstractOptions correctly applies HTML escaping to the option id and the displayed text based on the framework-level escape-model-strings setting. However, extension hooks that let developers attach arbitrary HTML attributes to each <option> do not apply the same neutralization. Any string returned by these overrides is concatenated directly into the tag markup.

Because an attacker only needs to influence data flowing into these attributes, exploitation is feasible in any application that exposes user-controllable values through the affected methods.

Root Cause

The root cause is missing output encoding in the code path that serializes additional HTML attributes for Palette options. The methods Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, and AbstractOptions.getAdditionalAttributes treat return values as trusted markup fragments. Wicket writes both attribute names and their values verbatim into the generated <option> tag, allowing attribute breakout and injection of event handlers such as onmouseover or onclick.

Attack Vector

Exploitation requires an application that overrides one of the three methods above and populates the returned map from user-supplied or otherwise attacker-influenced data. An authenticated attacker (PR:L) submits a payload containing quote characters and event-handler attributes. When any user renders a page containing the affected Palette, the browser parses the injected attributes and executes the attacker's JavaScript. Successful exploitation requires user interaction (UI:P) with the rendered control. Impact is scoped to the vulnerable subsystem's confidentiality and integrity.

No public proof-of-concept exploit is available at the time of publication. Refer to the Apache Mailing List Thread and Openwall OSS Security Update for the vendor's technical description.

Detection Methods for CVE-2026-76985

Indicators of Compromise

Unexpected HTML event-handler attributes (onmouseover, onclick, onerror) appearing inside <option> tags in rendered Wicket pages.
Outbound requests from user browsers to unfamiliar domains shortly after loading pages containing a Palette component.
Application logs showing anomalous characters (", <, >, =) in fields consumed by getAdditionalAttributes* overrides.

Detection Strategies

Static code review of Wicket applications for overrides of Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, and AbstractOptions.getAdditionalAttributes.
Software composition analysis to flag apache:wicket versions in the vulnerable ranges (8.0.0–8.18.0, 9.0.0–9.23.0, 10.0.0–10.10.0, or 1.4.x–7.x legacy releases).
Web application firewall rules that inspect responses for injected event handlers within <option> elements returned by Wicket endpoints.

Monitoring Recommendations

Correlate content security policy (CSP) violation reports with URLs that render Palette components.
Monitor authenticated session activity for XSS-consistent patterns such as session cookie theft attempts and unexpected DOM mutations.
Track dependency inventories continuously to identify newly disclosed vulnerable Wicket versions across build pipelines.

How to Mitigate CVE-2026-76985

Immediate Actions Required

Upgrade Apache Wicket to 8.19.0, 9.24.0, or 10.11.0, which contain the fix.
Audit application source for overrides of the three affected methods and confirm whether their return values incorporate untrusted data.
Enforce a strict Content Security Policy that disallows inline event handlers to reduce exploitability while patching.

Patch Information

The Apache Wicket project has released fixed versions 8.19.0, 9.24.0, and 10.11.0. Details are published in the Apache Mailing List Thread and the Openwall OSS Security Update. Upgrade paths preserve API compatibility within each major release line.

Workarounds

If upgrading is not immediately feasible, escape attribute names and values inside the override before returning them, using an HTML attribute encoder such as OWASP Java Encoder's Encode.forHtmlAttribute.
Restrict input sources feeding the affected overrides to allow-listed values that cannot contain HTML metacharacters.
Remove overrides entirely where the additional attributes are non-essential and rely on default framework behavior.

bash

# Example Maven dependency update to the patched release
mvn versions:use-dep-version -Dincludes=org.apache.wicket:wicket-core -DdepVersion=10.11.0 -DforceVersion=true
mvn versions:use-dep-version -Dincludes=org.apache.wicket:wicket-extensions -DdepVersion=10.11.0 -DforceVersion=true
mvn clean verify