Threats tagged 'ghsa-8xp3-3x4j-prp2'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a vulnerability where texts read from resource bundles are inserted into JavaScript string literals and HTML attributes without proper escaping. This can lead to script injection if the text contains quotes or malicious content. The default Content-Security-Policy in Wicket 9.x and 10.x does not prevent script injection in JavaScript contexts but does prevent inline event handler injection in attribute contexts. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.