CVE-2026-76982

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.25.0 through 8.18.0 Apache Wicket versions 7.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description Improper neutralization of input during web page generation occurs when the org.apache.wicket.markup.html.form.Button component is attached to a <button> element. The constructor clears the escape-model-strings flag to prevent double encoding of attribute values; however, when used with a <button> element, the model object is written into the element body without encoding. This allows markup within the model to be rendered as active markup if the data is influenced by an attacker. This issue also affects subclasses AjaxButton, AjaxFallbackButton, and WizardButton.

Recommendations Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, call setEscapeModelStrings(true) on any button rendering as a <button> element to ensure the body is escaped correctly.