Executive brief
Apache Wicket is a Java web framework used to build dynamic web applications. AjaxEditableChoiceLabel, a component for rendering editable dropdown fields, fails to escape HTML in display values provided by custom renderers. An attacker who controls the choice data can inject malicious scripts that execute in the browsers of all users viewing the affected page.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel components in wicket-extensions. When these components use a non-null IChoiceRenderer or override the defaultNullLabel() method, they write the returned display value directly into the label's HTML markup without applying HTML entity encoding. While the same value is correctly escaped when rendered in the dropdown editor, the label itself remains vulnerable. The escapeModelStrings configuration setting does not affect these components because it is read by a different inner component. The flaw requires an attacker to control or influence the choice/model data rendered by the label.
Affected products
- Apache Wicket 6.22.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Version 8.19.0, 9.24.0, and 10.11.0 contain fixes