Improper neutralization of input during web page generation in Apache Wicket. (CVE-2026-76984)

The vulnerability in Apache Wicket involves improper escaping of attribute values in the MetaDataHeaderItem class when generating <meta> and <link> header tags. While attribute names are escaped, attribute values are only processed by replacing double quotes with \" which is ineffective in HTML context, allowing an attacker to inject double quotes that terminate attribute values early and inject additional attributes. This issue affects versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0, as well as older unsupported versions from 6.17.0 onward. The vulnerability can be triggered if an application supplies attribute values influenced by an attacker, for example via addTagAttribute or factory methods forMetaTag and forLinkTag. The issue is resolved in Apache Wicket versions 8.19.0, 9.24.0, and 10.11.0.

An attacker able to control attribute values in affected Apache Wicket applications can inject double quotes that prematurely end attribute values in generated HTML tags, potentially leading to injection of additional attributes. This may result in cross-site scripting (CWE-79) or other injection-based attacks depending on the context and usage. The severity is assessed as medium. There are no known exploits in the wild at this time.

Users should upgrade affected Apache Wicket versions to 8.19.0, 9.24.0, or 10.11.0 where the issue is fixed. There is no configuration setting to mitigate this vulnerability; applications must avoid supplying attribute values containing double quotes if unable to upgrade. Patch status is confirmed fixed in the specified versions.