Live › vulnerability › CVE-2026-84231
ExternalLink writes its URL into a single-quoted JavaScript string in an onclick attribute when bound to a non-anchor tag such as a button or span, and only HTML-escapes the value. The browser decodes the escaped apostrophe, so an attacker-influenced URL breaks out of the string and runs script in the application's origin once a user clicks the element.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 23:22 UTC. All times on this page are UTC.
Applications built on Apache Wicket 8.0.0 through 8.19.0 are exposed when they bind an ExternalLink to a non-anchor markup tag and the URL in its model can be influenced by an attacker. Applications that only use ExternalLink on a, link or area tags, or that do not use ExternalLink, are not affected by the described path. Wicket 7.x and older are also affected and are no longer supported.
No product ranges from the sources yet.
ExternalLink bound to tags other than a, link or area, such as <button wicket:id=...> or <span wicket:id=...>.org.apache.wicket:wicket-core between 8.0.0 and , or any release.8.19.07.x8.20.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin.
An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.
Users are recommended to upgrade to version 8.20.0, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-84231")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.