CVE-2026-76985

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 1.4.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description Improper neutralization of input during web page generation occurs in the org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions component. While the component escapes the id and display value of options, it writes attribute names and values returned by the getAdditionalAttributes() function directly into the <option> tag without escaping. An application is susceptible if it overrides the Palette.getAdditionalAttributesForChoices(), Palette.getAdditionalAttributesForSelection(), or AbstractOptions.getAdditionalAttributes() functions and returns data that can be influenced by an attacker.

Recommendations Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0. As a temporary workaround, escape the values within the function overrides. Restrict the use of Palette.getAdditionalAttributesForChoices(), Palette.getAdditionalAttributesForSelection(), and AbstractOptions.getAdditionalAttributes() to ensure they do not return attacker-influenced data.