Threats tagged 'ghsa-f8h3-wpxx-57r3'

CVE-2026-83559 is a vulnerability in Apache Wicket affecting versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. It involves improper encoding or escaping of output in the JavaScriptUtils#escapeQuotes() method, which fails to escape backslashes properly. This can allow injected JavaScript code to execute in the context of the user's session if attacker-controlled input is passed through this method and embedded in JavaScript string literals. The issue is fixed in versions 8.20.0, 9.25.0, and 10.12.0.