Is CVE-2026-83559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83559 being exploited in the wild.

How severe is CVE-2026-83559?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0.

Is there a fix for CVE-2026-83559?

Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83559 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-83559?

Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83559: Apache Wicket improper escaping of quotes in JavaScript output

CVE-2026-83559 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework used to build interactive web applications. The framework's JavaScriptUtils.escapeQuotes() method fails to properly escape backslashes before quotes, allowing attackers to break out of JavaScript string literals and inject malicious code that executes in users' browsers within the application's security context. This could lead to session hijacking, credential theft, or other client-side attacks if applications use this method with attacker-controlled data.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-83559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83559 being exploited in the wild.
How severe is CVE-2026-83559?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0.
Is there a fix for CVE-2026-83559?: Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83559 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-83559?: Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.20.0, 9.25.0, 10.12.0

Technical details

The escapeQuotes() method escapes single and double quotes but fails to escape backslashes first, allowing an attacker to inject a backslash-quote sequence that results in an unescaped quote closing the JavaScript string literal. The vulnerability affects applications that call this public method to place results in JavaScript string literals, particularly those using AjaxEditableLabel which passes validation error messages through the escapeQuotes() method. No authentication or special network access is required; exploitation depends only on the application accepting attacker-influenced data in contexts where it reaches the vulnerable code path.

Affected products

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0

Timeline

2026-11-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.