CVE-2026-95863: Apache Wicket improper input neutralization in JavaScript generation

CVE-2026-95863 · Severity: info · Published 2026-11-01

Apache Wicket is a web application framework that generates HTML and JavaScript for web pages. When application data containing certain special characters (quotes, backslashes) is used as element IDs, Wicket fails to properly escape these characters in generated JavaScript code, allowing attackers to break out of string literals and inject arbitrary script that runs in the browser with the application's privileges. This could lead to session hijacking, credential theft, or malicious actions on behalf of the user.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-95863 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-95863 being exploited in the wild.
How severe is CVE-2026-95863?
Informational severity, published 1 November 2026.
Which products and versions are affected?
Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0; Apache Wicket Extensions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0.
Is there a fix for CVE-2026-95863?
Yes: fixed in Apache Wicket 8.20.0, 9.25.0, 10.12.0. Until then: Restrict or validate all user-supplied or dynamically-derived values used as component IDs and markup IDs to exclude special characters (quotes, backslashes, braces, angle brackets, semicolons, ampersands, parentheses, and square brackets) until you can upgrade to the fixed versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95863 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-95863?
Check whether you run Apache Wicket or Apache Wicket Extensions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Apache Wicket 8.20.0, 9.25.0, 10.12.0

Restrict or validate all user-supplied or dynamically-derived values used as component IDs and markup IDs to exclude special characters (quotes, backslashes, braces, angle brackets, semicolons, ampersands, parentheses, and square brackets) until you can upgrade to the fixed versions.

Technical details

The vulnerability is an improper neutralization of input during web page generation (CWE-95) where markup IDs and form component input names derived from application-supplied component IDs are inserted into JavaScript string literals without proper escaping. Attackers who can influence component IDs (either directly set by the application, from markup templates, or derived from user-controlled data) can inject quotes, backslashes, or other characters that break out of single-quoted string contexts and execute arbitrary JavaScript in the application's origin. The fix enforces strict validation of component IDs at creation time, rejecting characters that have special meaning in JavaScript contexts.

Affected products

  • Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0
  • Apache Wicket Extensions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0

Timeline

  • 2026-11-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.