CVE-2026-76983: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

The vulnerability in Apache Wicket involves improper neutralization of input during web page generation via the <wicket:label> tag, which is handled by AutoLabelTextResolver. This resolver writes label content directly into markup without escaping, ignoring the escape-model-strings setting. If an attacker can control the label model of a form component, they can inject malicious markup leading to cross-site scripting. The issue affects multiple supported and unsupported versions of Apache Wicket. The recommended fix is to upgrade to versions 8.19.0, 9.24.0, or 10.11.0 where the resolver behavior is corrected.

An attacker able to influence the label of a form component can inject malicious markup that is rendered unescaped in the web page, resulting in cross-site scripting. This can lead to execution of arbitrary scripts in the context of the affected application, potentially compromising user data or session integrity. The vulnerability requires the attacker to have some ability to control label content, and user interaction is needed to trigger the vulnerability. The CVSS 4.0 score is 5.1 (medium severity).

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 where this issue is fixed. There is no workaround or temporary fix available. Applications should avoid using untrusted data in form component labels until upgraded.