Apache Wicket: XSS in Palette via getAdditionalAttributes

org.apache.wicket:wicket-extensions · Cross-site scripting · CWE-79

Affectedorg.apache.wicket:wicket-extensions

FixNo fix listed yet.

PublishedAug 31, 13:22 · apache

ScoredAug 31 · 5.1 · apache

Exploit code publicNone known · checked 01:19 UTC

ExploitedNone known · CISA KEV checked 01:58 UTC

What we know

No known exploitation. CISA KEV, checked 01:58 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 01:19 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Someone has to open, click or run something first. CVSS: user interaction required.

Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came. An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected. As a workaround, escape the values in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

From apache

Affected and fixed versions

ProductAffectedFixed inorg.apache.wicket:wicket-extensions8.0.0 – 8.18.0–org.apache.wicket:wicket-extensions9.0.0 – 9.23.0–org.apache.wicket:wicket-extensions10.0.0 – 10.10.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

lists.apache.org/thread/0x2x12x22ff4yq4rhqokb2fjhtsd0f0j · lists.apache.orgvendor advisory

Other CVEs in org.apache.wicket:wicket-extensions

All 2 →

7.4Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data · CVE-2026-83539Nov 1 5.1Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel · CVE-2026-75802Aug 31