{"id":"CVE-2026-83539","kind":"vulnerability","aliases":["CVE-2026-83539"],"related":[],"title":"Apache Wicket: linkified text lets a crafted URL run script in users' sessions","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe.\n\nAn application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected.\n\nOn 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","summary":"SmartLinkLabel and SmartLinkMultiLineLabel turn any scheme://text found in displayed values into anchors without filtering schemes, so a javascript-style URL becomes a clickable script. An attacker who gets such text rendered can run script in the victim's session in the application's origin once the link is clicked.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","package","web-apps"],"not_affected_if":["default-csp-on-9x-10x","no-smartlink-components"],"how_to_check":"- Search the application code for `SmartLinkLabel` and `SmartLinkMultiLineLabel`; if neither is used, the application is not affected.\n- Check the Wicket version in the build file (for example `pom.xml` or `build.gradle`) against the affected ranges: 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0.\n- Check whether a Content-Security-Policy is sent and whether it was weakened or disabled.","fix":"- Apache Wicket 8.x: upgrade to `8.20.0`\n- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`\n- Wicket 7.x and older: no fix in a supported line; move to a supported version","status":"open","published_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:29+00:00","updated_at":"2026-11-01T23:23:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T23:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Wicket 8.x: upgrade to `8.20.0`\n- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`\n- Wicket 7.x and older: no fix in a supported line; move to a supported version","reach":"internet","title":"Apache Wicket: linkified text lets a crafted URL run script in users' sessions","impact":"high","summary":"SmartLinkLabel and SmartLinkMultiLineLabel turn any scheme://text found in displayed values into anchors without filtering schemes, so a javascript-style URL becomes a clickable script. An attacker who gets such text rendered can run script in the victim's session in the application's origin once the link is clicked.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-wicket","java","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in victim's session on the application origin","analyst_note":"","how_to_check":"- Search the application code for `SmartLinkLabel` and `SmartLinkMultiLineLabel`; if neither is used, the application is not affected.\n- Check the Wicket version in the build file (for example `pom.xml` or `build.gradle`) against the affected ranges: 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0.\n- Check whether a Content-Security-Policy is sent and whether it was weakened or disabled.","plain_action":"","needs_analyst":false,"not_affected_if":["no-smartlink-components","default-csp-on-9x-10x"],"who_is_affected":"Applications that render user-supplied text through SmartLinkLabel or SmartLinkMultiLineLabel are exposed; applications using neither component are not. On Wicket 9.x and 10.x the default Content-Security-Policy blocks the script unless it was weakened or disabled, and Wicket 8.x has no CSP support so it is affected as it stands.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000863,"input_tokens":4863,"output_tokens":754,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-83539':16A,19A '10':349C '10.0.0':459C '10.11.0':461C '10.12.0':491C '7':466C '8':428C '8.0.0':451C '8.19.0':453C '8.20.0':488C '9':346C '9.0.0':455C '9.24.0':457C '9.25.0':489C 'accept':149C 'activ':212C 'address':294C 'admit':360C 'affect':270C,344C,424C,441C,447C 'alon':241C 'anchor':39B,135C,176C 'anyth':124C 'anywher':160C 'apach':1A,21B,87C,448C,464C 'apache-wicket':20B 'app':27B 'applic':70B,182C,268C,303C,335C,405C 'attack':54B 'becom':49B,174C 'cannot':379C 'carri':366C,380C 'charact':224C 'click':77B,195C 'clickabl':51B 'compon':282C,329C,403C 'configur':324C 'content':353C,413C,433C 'content-security-polici':352C,412C,432C 'context':258C 'copi':142C 'craft':7A 'cve':14A,17A 'data':262C,301C 'default':359C,384C,397C 'disabl':410C 'display':36B,92C,305C 'either':278C 'element':253C 'email':293C 'end':245C 'enough':203C 'escap':108C,116C,213C,260C 'escapemarkup':239C 'execut':171C,178C,377C 'exist':290C 'featur':314C 'filter':41B 'find':101C 'fix':493C 'form':127C 'found':34B,298C 'full':426C 'generat':85C 'get':56B 'hand':114C 'href':137C 'hyperlink':106C 'improp':78C 'input':81C,308C 'involv':326C 'issu':222C,446C,495C 'java':23B 'javascript':46B 'javascript-styl':45B 'leav':240C 'let':5A 'link':75B,197C,208C 'linkifi':3A,292C 'list':156C 'longer':473C 'make':265C 'match':132C,140C 'misus':318C 'model':110C,261C 'name':167C 'need':227C 'neither':338C 'neutral':79C 'nonc':371C 'older':469C 'one':236C,381C 'org.apache.wicket.extensions.markup.html.basic.defaultlinkparser':119C 'org.apache.wicket.extensions.markup.html.basic.smartlinklabel':89C 'org.apache.wicket.extensions.markup.html.basic.smartlinkmultilinelabel':91C 'org.apache.wicket.util.string.strings':238C 'origin':72B,184C 'packag':24B 'page':84C,200C 'parser':332C 'path':163C 'pattern':148C 'payload':226C 'per':369C 'per-respons':368C 'permit':158C 'polici':355C,385C,398C,415C,435C 'prevent':216C 'properti':394C 'purpos':311C 'rather':250C,315C 'reader':188C,194C 'reason':422C 'receiv':276C 'recommend':483C 'render':59B,198C,273C 'respons':370C 'rest':128C 'run':9A,61B,390C 'safe':266C 'scheme':42B,151C,159C,169C,376C 'script':10A,52B,62B,172C,361C,378C,388C 'search':121C 'secur':354C,414C,434C 'send':357C 'session':13A,67B,191C 'smartlinklabel':28B,339C 'smartlinkmultilinelabel':30B,341C 'sourc':365C 'stand':444C 'stop':386C 'style':47B 'support':436C,474C,479C 'text':4A,33B,58B,94C,117C,141C,165C,254C,274C 'therefor':173C 'turn':31B,97C 'two':281C 'unrel':421C 'untrust':307C 'unusu':323C 'upgrad':476C,485C 'url':8A,48B,99C,233C,249C,297C,374C 'use':330C,337C 'user':12A,462C,481C 'valid':230C 'valu':37B,95C,111C,166C,244C 'version':480C,487C 'victim':65B 'weaken':408C 'web':26B,83C,296C 'web-app':25B 'whose':136C,375C 'wicket':2A,22B,88C,356C,427C,449C,465C 'without':40B 'wrap':130C 'x':347C,350C,429C,467C","nicknames":[],"mitigations":[],"who_affected":"Applications that render user-supplied text through SmartLinkLabel or SmartLinkMultiLineLabel are exposed; applications using neither component are not. On Wicket 9.x and 10.x the default Content-Security-Policy blocks the script unless it was weakened or disabled, and Wicket 8.x has no CSP support so it is affected as it stands.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T23:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83539","severity":null,"published_at":"2026-11-01T23:17:29+00:00","modified_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}