CVE-2026-82956

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0

Description Improper neutralization of input during web page generation occurs when the org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior component processes the windowName request parameter. The application stores the client-supplied window name in the page's serialized state. During subsequent renders, this value is substituted into a single-quoted JavaScript string literal and written as raw JavaScript without proper escaping or validation. An attacker can provide a window name containing a single quote to terminate the literal and execute arbitrary script in the application's origin. This issue only affects applications that have explicitly added AjaxNewWindowNotifyingBehavior to a component.

Recommendations Upgrade Apache Wicket versions 8.0.0 through 8.19.0 to version 8.20.0. Upgrade Apache Wicket versions 9.0.0 through 9.24.0 to version 9.25.0. Upgrade Apache Wicket versions 10.0.0 through 10.11.0 to version 10.12.0.