Severity: important
CVSS 4.0: 7.6 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.19.0
- Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.24.0
- Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0
Description:
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page
instance has been opened in a second browser window or tab. It asks the browser
for the value of window.name, which reaches the server as the request parameter
windowName, and remembers what the browser reported in a field of the
behaviour. That field is part of the page's serialized state, so the remembered
value stays in the page store for as long as the page instance does.
On every later render of that page instance the behaviour builds the
precondition of its Ajax call by substituting the remembered value into a
single-quoted JavaScript string literal, and Wicket writes that precondition
into the page as raw JavaScript, because the precondition of an Ajax call
listener is script supplied by the caller and is emitted without quoting or
escaping. Nothing on that path escapes the value. The window name is
client-supplied and Wicket applies no validation to it, so a remembered name
containing a single quote ends the literal and the rest of it runs as script in
the application's origin, every time that page instance is rendered.
An application is affected only where it has explicitly added
AjaxNewWindowNotifyingBehavior to a component. No part of the framework
installs the behaviour, so an application that does not use it is not affected.
The name the behaviour generates for itself, when the browser reports no name
at all, is a random UUID and is not client-supplied.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through
9.24.0, from 10.0.0 through 10.11.0.
Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which
fix the issue.
Credit:
Emond Papegaaij (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-82956
