Executive brief
Apache Wicket is a Java web application framework used to build interactive web applications. The Palette component contains a cross-site scripting (XSS) vulnerability in how it renders option lists. If an application customizes how additional attributes are displayed in the Palette component, attackers can inject malicious code that executes in users' browsers, potentially stealing session data or performing unauthorized actions.
Technical details
The vulnerability is an improper neutralization of input during web page generation (CWE-79, XSS) in the AbstractOptions component of Apache Wicket's Palette widget. The root cause is that while the component correctly escapes option IDs and display values according to the escape-model-strings setting, it fails to escape attribute names and values returned by getAdditionalAttributes methods. An application is only affected if it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes and returns attacker-controllable data. The attack vector is network-based, requiring no authentication, and allows an attacker to inject arbitrary HTML/JavaScript into the rendered page. The vulnerability has been patched in versions 8.19.0, 9.24.0, and 10.11.0; applications can also mitigate by escaping values in their overrides.
Affected products
- Apache Wicket 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and older unsupported releases from 1.4.0 onwards
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patched in versions 8.19.0, 9.24.0, and 10.11.0