CVE-2026-76984

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 6.17.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description Improper neutralization of input during web page generation occurs in the org.apache.wicket.markup.head.MetaDataHeaderItem class, which generates <meta> and <link> header tags. The software incorrectly handles attribute values by replacing double quotes with backslashes. Since backslashes have no special meaning in HTML, a double quote can prematurely terminate an attribute, allowing subsequent data to be parsed as additional attributes of the generated tag. This issue occurs when an application provides attribute values that an attacker can influence via the addTagAttribute method or the forMetaTag and forLinkTag factory methods.

Recommendations Upgrade Apache Wicket versions 6.17.0 through 8.18.0 to version 8.19.0. Upgrade Apache Wicket versions 9.0.0 through 9.23.0 to version 9.24.0. Upgrade Apache Wicket versions 10.0.0 through 10.10.0 to version 10.11.0. Avoid supplying attribute values that contain double quotes to the affected methods.