CVE-2026-76986

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 1.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description Improper neutralization of input during web page generation occurs in the org.apache.wicket.markup.html.form.AbstractSingleSelectChoice class, which serves as the base class for DropDownChoice. The software writes the body of the default option into the markup without escaping it, whereas other option bodies are escaped based on the escape-model-strings setting. The affected content is retrieved via the getNullValidDisplayValue() or getNullKeyDisplayValue() functions. An application is susceptible if it overrides these methods to return attacker-influenced data or if the null bundle entry contains such data.

Recommendations Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, escape the value within the method override.