CVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributes

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-01
Weakness: CWE-79

Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came. An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected. As a workaround, escape the values in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

Affected products

Apache Software Foundation Apache Wicket: from 8.0.0 before 8.19.0; from 9.0.0 before 9.24.0; from 10.0.0 before 10.11.0 — fixed in 10.11.0, 8.19.0, 9.24.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Wicket 10.11.0, 8.19.0, 9.24.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-76985 or the next vulnerability affects your stack