CVE-2026-76986 Overview
CVE-2026-76986 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Apache Wicket, a component-based Java web application framework. The flaw resides in org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice. Wicket writes the body of the default option — the entry shown when no choice is selected — into the markup without escaping. All other option bodies in the same <select> are escaped according to the escape-model-strings setting. Applications that override getNullValidDisplayValue() or getNullKeyDisplayValue() and return attacker-influenced data expose users to script injection through the rendered page.
Critical Impact
Attackers can inject arbitrary HTML or JavaScript into pages rendered by affected Wicket applications, enabling session theft, credential harvesting, and client-side action forgery when a user interacts with a crafted link.
Affected Products
- Apache Wicket 8.0.0 through 8.18.0
- Apache Wicket 9.0.0 through 9.23.0
- Apache Wicket 10.0.0 through 10.10.0 (older unsupported releases from 1.5.0 onward are also affected)
Discovery Timeline
- 2026-08-31 - CVE-2026-76986 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-76986
Vulnerability Analysis
Apache Wicket renders single-select choice components such as DropDownChoice by emitting an initial default <option> element followed by user-provided option entries. Wicket escapes the bodies of user-provided entries when escape-model-strings is enabled, which is the framework default. The default option body is written to the markup verbatim. This asymmetric handling produces an HTML injection sink whenever the source of the default value is not trusted plain text.
The default value comes from two protected methods: getNullValidDisplayValue() and getNullKeyDisplayValue(). The reference implementation reads plain-text entries from a resource bundle, so stock configurations are safe. Applications that override either method and substitute user-controlled data, request parameters, or database content propagate raw markup into the DOM.
Root Cause
The root cause is inconsistent output encoding within a single component. The framework treats the default option as a trusted internal value while treating sibling options as untrusted. When developers override the protected accessors to satisfy localization or dynamic labeling requirements, they inherit an implicit contract that the returned string must already be HTML-safe. This contract is not enforced or documented at the call site, producing a classic improper neutralization defect [CWE-79].
Attack Vector
Exploitation requires an affected application to expose an overridden getNullValidDisplayValue() or getNullKeyDisplayValue() method whose return value derives from attacker-controlled input. An attacker supplies a payload containing HTML or JavaScript through the corresponding input channel, then lures a victim to the page rendering the vulnerable DropDownChoice. The victim's browser parses the unescaped markup and executes the injected script in the application's origin. RadioChoice overrides getDefaultChoice to emit no default option and is not affected.
The vulnerability requires user interaction and operates over the network with low attack complexity. Refer to the Apache Mailing List Thread and the Openwall OSS-Security Update for the vendor discussion.
Detection Methods for CVE-2026-76986
Indicators of Compromise
- HTTP request parameters or stored fields feeding DropDownChoice defaults that contain <script>, onerror=, javascript:, or encoded HTML entities.
- Rendered HTML responses where the first <option> element inside a Wicket-generated <select> contains tag characters that were not escaped.
- Browser console errors or Content Security Policy (CSP) violations originating from pages that render form components with dynamic null-display values.
Detection Strategies
- Perform static analysis of the application codebase for overrides of getNullValidDisplayValue() and getNullKeyDisplayValue() and trace data flow from HTTP inputs to the return value.
- Audit Wicket resource bundle entries keyed as nullValid or null for values containing HTML metacharacters.
- Enable web application firewall (WAF) inspection of parameters bound to form fields backed by AbstractSingleSelectChoice subclasses.
Monitoring Recommendations
- Log and alert on CSP report-uri or report-to violations that indicate inline script execution on pages rendering Wicket form components.
- Capture outbound HTTP responses in a staging environment and diff the rendered <select> markup before and after user input is submitted.
- Monitor authentication and session events for anomalies immediately following interaction with pages that use dynamic null-display values.
How to Mitigate CVE-2026-76986
Immediate Actions Required
- Upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 depending on the branch currently deployed.
- Inventory all subclasses of DropDownChoice and AbstractSingleSelectChoice within the application for overrides of the affected methods.
- Sanitize or HTML-escape any attacker-influenced string returned from getNullValidDisplayValue() or getNullKeyDisplayValue() prior to upgrade.
Patch Information
The Apache Wicket project addressed CVE-2026-76986 in versions 8.19.0, 9.24.0, and 10.11.0. Patched releases apply escaping to the default option body consistent with the treatment of other option bodies. Refer to the Apache Mailing List Thread for the official vendor advisory and release notes.
Workarounds
- Escape the returned value inside any override of getNullValidDisplayValue() or getNullKeyDisplayValue() using Wicket's Strings.escapeMarkup() utility.
- Replace dynamic null-display content with static, localized strings drawn from trusted resource bundles until the patch is applied.
- Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of successful injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.