Executive brief
Apache Wicket is a Java-based web framework used to build dynamic web applications. The <wicket:label> tag renders form component labels without properly escaping user-controlled input, allowing attackers to inject malicious HTML or JavaScript into web pages. An attacker who can influence a form label (e.g., through a stored database field or request parameter) can execute arbitrary code in users' browsers, potentially compromising session tokens or sensitive data.
Technical details
The vulnerability is an improper neutralization of input during web page generation (CWE-79: Cross-site Scripting) in the AutoLabelTextResolver component. The resolver renders form component labels from the label model set via FormComponent#setLabel(IModel) without consulting the escape-model-strings setting or applying any HTML escaping, unlike all other Wicket rendering paths. An attacker can exploit this by injecting markup or script content into label data that originates from untrusted sources (request data or compromised storage). The attack requires the application to use the <wicket:label> tag for components with user-influenced labels. Fixes are available in Wicket 8.19.0, 9.24.0, and 10.11.0; no workaround exists for earlier versions.
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and unsupported versions from 1.5.0 onwards
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in versions 8.19.0, 9.24.0, and 10.11.0