Improper neutralization of input during web page generation in Apache Wicket. (CVE-2026-76986)

CVE-2026-76986 describes an improper input neutralization vulnerability in Apache Wicket's AbstractSingleSelectChoice class, which underpins DropDownChoice components. The default option's body is written into markup without escaping, unlike other options that respect the escape-model-strings setting. If an application overrides getNullValidDisplayValue() or getNullKeyDisplayValue() to return attacker-influenced data, this can lead to injection of unescaped content in the generated web page. The vulnerability affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue is fixed in versions 8.19.0, 9.24.0, and 10.11.0. RadioChoice components are not affected as they do not emit a default option.

This vulnerability allows an attacker to inject unescaped content into the default option of a DropDownChoice component if the application overrides certain methods to return attacker-controlled data. This can lead to cross-site scripting (XSS) attacks, potentially compromising confidentiality and integrity of user sessions. The CVSS score of 6.1 (medium severity) reflects the network attack vector with low complexity, no privileges required, but user interaction needed, and partial impact on confidentiality and integrity.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, where this issue is fixed. As a workaround, applications overriding getNullValidDisplayValue() or getNullKeyDisplayValue() should ensure the returned values are properly escaped before rendering. No other mitigation is indicated by the vendor advisory.