Improper neutralization of input during web page generation in Apache Wicket. (CVE-2026-76985)

The vulnerability arises from the AbstractOptions component in Apache Wicket, which escapes option ids and display values but writes additional attributes returned by overridden methods directly into <option> tags without escaping. Applications that override Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and return attacker-influenced data are vulnerable. The default implementations return null, so only applications that override these methods improperly are affected. The recommended fix is to upgrade to Apache Wicket versions 8.19.0, 9.24.0, or 10.11.0, which address this issue by ensuring proper escaping.

If exploited, this vulnerability could allow injection of unescaped data into web pages generated by Apache Wicket, potentially leading to cross-site scripting (XSS) attacks. However, only applications that override specific methods to add unescaped, attacker-controlled attributes are affected. Applications that do not override these methods are not vulnerable. There are no known exploits in the wild at this time.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 where the issue is fixed. As a workaround, applications overriding the affected methods should ensure that any returned attribute values are properly escaped before being written into <option> tags. No other action is required for applications that do not override these methods.