Threats tagged 'ghsa-f448-r48f-qjch'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a vulnerability in the SmartLinkLabel and SmartLinkMultiLineLabel components. These components convert URLs found in text into clickable links without restricting URL schemes, allowing potentially malicious schemes that execute scripts when a user clicks the link. The default Content-Security-Policy in Wicket 9.x and 10.x mitigates this by requiring a nonce for script execution, but Wicket 8.x lacks this protection. Applications that weaken or disable the default Content-Security-Policy are fully affected. Upgrading to versions 8.20.0, 9.25.0, or 10.12.0 resolves the issue.