Severity: important
CVSS 4.0: 7.4 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0
Description:
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click
handler and writes it into the tag's onclick attribute whenever the markup tag
the component is bound to is not an a, link or area element. The URL held in
the component's model is concatenated into a single-quoted JavaScript string
literal in that handler without being escaped for that context. The same
happens on the neighbouring branch, taken when popup settings are attached,
where the value is concatenated into the window.open() call built by
org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only
escaping applied is the markup escaping that every attribute value receives as
the tag is written, which replaces an apostrophe with a character reference. A
browser decodes character references in an attribute value before it compiles
the event handler, so the apostrophe is restored, closes the string literal,
and the rest of the model value is executed as script in the application's
origin.
An application is affected where it binds an ExternalLink to a markup tag that
is not an anchor, such as a button or a span, and the URL in the model holds
data an attacker can influence, which is the ordinary use of the component
rather than a misuse of it. Nothing runs until a user activates the element.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache
Wicket 7.x or older, which are no longer supported, should upgrade to a
supported version.
Users are recommended to upgrade to version 8.20.0, which fixes the issue.
Credit:
Emond Papegaaij (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-84231
