Severity: moderate
CVSS 4.0: 7.4 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0
- Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0
- Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0
Description:
Improper encoding or escaping of output in Apache Wicket.
org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each
single quote in its input with a backslash and a single quote, and each double
quote with a backslash and a double quote, so that the value can be placed
inside a JavaScript string literal. It does not escape the backslash, which is
the character that has to be escaped, and escaped first, for the rest of that
escaping to hold. A value that already holds a backslash immediately before a
quote therefore ends up with two backslashes in front of that quote: the first
escapes the second, the quote itself is left unescaped, and it closes the
literal. Whatever the value carries after that point is no longer text but
JavaScript, and it runs in the application's origin and in the session of the
user looking at the page. The method is public, is not deprecated, and its
documentation states that its result can be part of a JavaScript call such as
an alert; the only limitation it notes concerns JSON values, which need
different escaping.
An application is affected wherever it calls the method itself and places the
result inside a JavaScript string literal, from its own code or from a
component of its own or of a third party, and the value it escapes holds data
an attacker can influence. There is no further condition, and no component of
Wicket has to be involved: the application is using the method for what its
documentation offers, and the method does not deliver it.
Two components shipped with Wicket Extensions pass a value through the method.
org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the
editor's first error feedback message into a single-quoted JavaScript string
literal in the Ajax response, so an application is affected through that
component where the message shown for a failed edit holds data an attacker can
influence, whether that is the submitted value itself or another variable the
application sets on the validation error. A validation message can carry the
submitted value, because input is a message variable that every form component
supplies for its own validation errors, and the documentation shows overriding
a validator's message to include it; none of the message bundles shipped with
Wicket interpolates it, so an application that has not written such a message
is not affected through this component.
org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the
serialized markup tag of an appended component through the method and is not
affected: the tag comes from the panel's own markup file, and a quote in any of
its attribute values, the component's markup id included, is written as a
character reference by the tag serialization and cannot close the literal.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through
9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which
are no longer supported, should upgrade to a supported version.
Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which
fix the issue.
Credit:
Emond Papegaaij (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-83559
