Executive brief
Apache Wicket is a Java web application framework used to build dynamic web pages. The MetaDataHeaderItem component generates HTML meta and link tags but fails to properly escape attribute values containing quotes, allowing attackers to inject malicious HTML attributes or break out of tag context. An attacker who can control data passed as attribute values can inject arbitrary HTML attributes to steal credentials, redirect users, or perform other client-side attacks.
Technical details
The vulnerability is an improper input neutralization (CWE-79 equivalent) in the MetaDataHeaderItem class. The component escapes attribute names but only performs a naive replacement of double quotes with backslashes in attribute values, which has no effect in HTML context—allowing a double quote to prematurely terminate the attribute value and inject additional attributes. The vulnerability affects applications that supply attribute values via addTagAttribute, forMetaTag, or forLinkTag methods where the value is influenced by an attacker. Attack vector is network-based if the application reflects untrusted input into meta/link tag attributes; no authentication is required. An attacker can inject malicious attributes such as event handlers or modify attribute semantics. Patches are available in versions 8.19.0, 9.24.0, and 10.11.0.
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and 6.17.0 onwards (unsupported)
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in versions 8.19.0, 9.24.0, and 10.11.0