Improper neutralization of input during web page generation in Apache Wicket. (CVE-2026-76982)

The vulnerability arises because the org.apache.wicket.markup.html.form.Button component disables escaping of model strings for the value attribute to avoid double encoding. However, when the Button is attached to a <button> element, it writes the model object into the element body, which is not encoded, allowing potentially malicious markup to be rendered. This affects Button and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton if the model data can be influenced by an attacker. The vulnerability is present in Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and older unsupported versions from 6.25.0 and 7.5.0 onwards. The recommended fix is to upgrade to versions 8.19.0, 9.24.0, or 10.11.0 where the issue is resolved.

An attacker who can influence the model data rendered by a Button component attached to a <button> element can inject unencoded markup into the page body, potentially leading to cross-site scripting (XSS) vulnerabilities. This can allow execution of arbitrary scripts in the context of the affected web application, impacting confidentiality and integrity of user interactions. The vulnerability requires that the attacker can control the model data rendered by the Button component.

Users should upgrade Apache Wicket to version 8.19.0, 9.24.0, or 10.11.0 where this vulnerability is fixed. As a workaround, calling setEscapeModelStrings(true) on Button components rendered as <button> elements will correctly escape the element body and prevent unencoded markup rendering without causing double encoding. No other generic mitigations are specified by the vendor advisory.