Severity:
CVSS 4.0: 7.6 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket 8.0.0 through 8.19.0
- Apache Wicket 9.0.0 through 9.24.0
- Apache Wicket 10.0.0 through 10.11.0
Description:
Apache Wicket reads texts from the application's resource bundles — a localized
label, a css class name — and writes some of them into the JavaScript and the
markup it generates for a component. Those texts are placed inside
single-quoted JavaScript string literals and inside quoted attribute values
without being escaped for that context, so a text containing a quote ends the
literal or the attribute, and what follows is parsed as script or as markup in
the application's origin when the page loads.
A resource bundle entry is authored for the application and does not say where
the framework will write it. The same key is read by the framework into element
text, where Wicket escapes it, and into the contexts below, where it did not. A
text containing an apostrophe, which is ordinary in several languages, is
enough to break the page; a text under the influence of another party is enough
to run script.
In org.apache.wicket:wicket-core,
org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the
org.apache.wicket.mfu.delete message into a JavaScript string literal, and
org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into
the class attribute of the container it renders for its hidden fields; on 8.0.0
through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes
the same css class into a second container. In
org.apache.wicket:wicket-extensions, UploadProgressBar writes its
UploadProgressBar.starting text into a JavaScript string literal, FilterForm
writes the hidden-fields css class into the class attribute of its hidden input
markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0
TrapFocusBehavior writes its current css class into a JavaScript string literal.
The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default
does not prevent the JavaScript cases: the generated script is written into a
script element carrying the per-response nonce, so the injected code is part of
a script the policy admits. It does prevent an inline event handler injected
through the attribute cases.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through
9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which
are no longer supported, should upgrade to a supported version. Users are
recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the
issue.
Credit:
Pedro Santos (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-111089
