CVE-2026-76984: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

Apache Wicket's MetaDataHeaderItem component improperly neutralizes input during web page generation by escaping attribute names but only replacing double quotes in attribute values with a backslash-quote sequence, which is ineffective in HTML. This allows an attacker who can influence attribute values (via addTagAttribute or related factory methods) to inject double quotes that break out of the intended attribute context, enabling cross-site scripting. The vulnerability affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue was addressed in versions 8.19.0, 9.24.0, and 10.11.0.

An attacker able to supply attribute values containing double quotes can inject malicious scripts into web pages generated by Apache Wicket, leading to cross-site scripting attacks. This can result in execution of arbitrary scripts in the context of the affected application, potentially compromising user data or session integrity. The vulnerability requires the attacker to influence attribute values used in meta or link header tags.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, where this vulnerability is fixed. There is no configuration setting to mitigate this issue; avoiding supplying attribute values containing double quotes can reduce risk but is not a complete fix. Patch status is confirmed by the vendor advisory indicating fixed versions.