Live › vulnerability › CVE-2026-83559
Wicket's JavaScriptUtils.escapeQuotes() does not escape backslashes, so a value ending in a backslash before a quote can break out of a JavaScript string literal. An attacker-influenced value can then run script in the application's origin in the victim's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 23:22 UTC. All times on this page are UTC.
An application is exposed when it calls JavaScriptUtils.escapeQuotes() itself and places the result inside a JavaScript string literal, with the escaped value influenced by an attacker. It also applies to AjaxEditableLabel when its validation message includes the submitted input value, which requires an application-written message; AjaxListPanel is not affected. Applications that never call this method in JavaScript contexts and do not use that message pattern can skip it.
No product ranges from the sources yet.
wicket-core in pom.xml or build.gradleJavaScriptUtils.escapeQuotes whose output is placed inside a JavaScript string literalAjaxEditableLabel is used with validation messages that include the submitted input value8.20.09.25.010.12.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper encoding or escaping of output in Apache Wicket.
org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping.
An application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it.
Two components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on the validation error. A validation message can carry the submitted value, because input is a message variable that every form component supplies for its own validation errors, and the documentation shows overriding a validator's message to include it; none of the message bundles shipped with Wicket interpolates it, so an application that has not written such a message is not affected through this component. org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the serialized markup tag of an appended component through the method and is not affected: the tag comes from the panel's own markup file, and a quote in any of its attribute values, the component's markup id included, is written as a character reference by the tag serialization and cannot close the literal.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.
Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-83559")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.