Cross-site scripting in Apache Wicket - CVE-2026-76986
Published: August 31, 2026
Vulnerability identifier: #VU146321
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-76986
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in org.apache.wicket.markup.html.form.AbstractSingleSelectChoice when rendering the default option body from getNullValidDisplayValue() or getNullKeyDisplayValue(). A remote attacker can supply crafted data that is written into the markup without escaping to execute arbitrary script code in the victim's browser.
Applications are affected when they override those methods to return attacker-influenced data, or when their nullValid or null bundle entry contains such data. RadioChoice is not affected.
Affected software
Apache Wicket
How to mitigate CVE-2026-76986
Install security update from vendor's website.
Apache Wicket - addressed in versions 8.19.0, 9.24.0, 10.11.0