CVE-2026-76986: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

This vulnerability involves improper neutralization of input during web page generation in Apache Wicket's AbstractSingleSelectChoice component. Specifically, the default option body, which is shown when no choice is selected, is written into the markup without escaping if overridden by an application. This can lead to cross-site scripting if the overridden methods return attacker-controllable data. The issue affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The vendor recommends upgrading to versions 8.19.0, 9.24.0, or 10.11.0 or later to remediate the vulnerability.

Successful exploitation could allow an attacker to inject malicious scripts into web pages generated by Apache Wicket applications, potentially leading to limited confidentiality and integrity impacts via cross-site scripting. The vulnerability does not affect availability. The CVSS 3.1 vector indicates the attack requires network access, no privileges, user interaction, and results in partial confidentiality and integrity impact with scope changed.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, which contain fixes for this vulnerability. As a workaround, applications overriding the affected methods should ensure that returned values are properly escaped to prevent injection of malicious content. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the recommended upgrade versions indicate an official fix is available.