{"id":"CVE-2026-95863","kind":"vulnerability","aliases":["CVE-2026-95863"],"related":[],"title":"Apache Wicket: unescaped ids let injected script run in pages","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\nApache Wicket generates JavaScript that refers to the elements it renders, and\nwrites into that JavaScript two values it derives itself: a component's markup\nid, and the input name of a form component, which is built from component ids.\nBoth are placed inside single-quoted JavaScript string literals without being\nescaped for that context, so a value containing a single quote or a backslash\nends the literal, and what follows is parsed as script and runs in the\napplication's origin when the page loads.\n\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),\nor the id attribute written in the component's markup, or an id Wicket\ngenerates, in that order. The first two are supplied by the application in an\nHTML context, where both characters are legal and where Wicket escapes them\ncorrectly when it writes the same value into the id attribute of the element; a\ngenerated id cannot contain either. An input name is derived from the ids of the\ncomponents between the form and the form component, and a component id was\nrejected only for ':' and '~'.\n\nIn org.apache.wicket:wicket-core on 9.x and 10.x,\norg.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,\nCharSequence) quotes the id it is given into a Wicket.Event.add call, and\ncomponents in both wicket-core and wicket-extensions reach it through\n#forComponent(Component, String, CharSequence). On every affected version,\norg.apache.wicket.markup.html.form.Form writes its markup id and the id of its\nhidden-fields container into such literals,\norg.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input\nname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes\ntwo markup ids and an input name. On 8.x, Form also writes an input name into the\naction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField\nwrites an input name into a name attribute with no escaping at all, so a value\ncontaining a double quote escapes the attribute into markup.\n\norg.apache.wicket:wicket-extensions is affected in its own right and not only\nthrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,\nAjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,\nFilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build\ntheir own JavaScript containing a markup id.\n\nAn application is affected where a markup id or a component id carries one of\nthose characters. Wicket does not put one there itself, so the value comes from\nthe application: an id set on a component, an id attribute in a template, or a\ncomponent id derived from data. None of those is a JavaScript context from the\napplication's point of view.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does\nnot prevent this. The generated script is written into a script element carrying\nthe per-response nonce, so the injected code is part of a script the policy\nadmits.\n\nThe fixed versions check an id where it enters instead of escaping each place it\nis written. A component id and a markup id may no longer contain a quote, a\nbackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a\ncontrol character, and a markup id may not contain parentheses or square\nbrackets either; a component constructed with such an id, or given such a markup\nid, fails with an exception.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through\n9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which\nare no longer supported, should upgrade to a supported version. Users are\nrecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","summary":"Apache Wicket writes component and markup ids into generated JavaScript without escaping them, so a value containing a single quote or backslash breaks out of the string and runs as script in the application's origin. The Content-Security-Policy Wicket sends by default does not block the injected code.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","package","self-hosted","wicket-extensions"],"not_affected_if":["fixed-version","static-ids-only"],"how_to_check":"- Check the Wicket version in the build file, for example `org.apache.wicket:wicket-core` in `pom.xml` or `build.gradle`, and compare it to the affected ranges.\n- Search application code for `setMarkupId(` and for component ids built from user data, and look for values that can contain a quote, backslash or angle bracket.\n- Check `id` attributes in templates for values taken from request data.","fix":"- Upgrade `wicket` 8.x to `8.20.0` or later.\n- Upgrade `wicket` 9.x to `9.25.0` or later.\n- Upgrade `wicket` 10.x to `10.12.0` or later.","status":"open","published_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:23+00:00","updated_at":"2026-11-01T23:23:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-01T23:23:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `wicket` 8.x to `8.20.0` or later.\n- Upgrade `wicket` 9.x to `9.25.0` or later.\n- Upgrade `wicket` 10.x to `10.12.0` or later.","reach":"internet","title":"Apache Wicket: unescaped ids let injected script run in pages","impact":"high","summary":"Apache Wicket writes component and markup ids into generated JavaScript without escaping them, so a value containing a single quote or backslash breaks out of the string and runs as script in the application's origin. The Content-Security-Policy Wicket sends by default does not block the injected code.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-wicket","java","wicket-extensions","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in the application's origin, reading session data.","analyst_note":"Confirm which real pages set ids from request data; NVD text alone does not say how common the trigger is.","how_to_check":"- Check the Wicket version in the build file, for example `org.apache.wicket:wicket-core` in `pom.xml` or `build.gradle`, and compare it to the affected ranges.\n- Search application code for `setMarkupId(` and for component ids built from user data, and look for values that can contain a quote, backslash or angle bracket.\n- Check `id` attributes in templates for values taken from request data.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","static-ids-only"],"who_is_affected":"Applications built on Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, or 10.0.0 to 10.11.0 are exposed, and wicket-extensions is affected on its own. Exposure needs a markup id or component id that carries a quote, backslash or other special character, which usually means the value came from data or from application code that sets ids dynamically. Applications on fixed versions, or that never set ids from untrusted input, are lower risk. Wicket 7.x and older are unsupported and should be upgraded.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000916,"input_tokens":5296,"output_tokens":773,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95863':13A,16A '10':284C,434C,523C '10.0.0':647C '10.11.0':649C '10.12.0':679C '7':654C '8':356C,373C '8.0.0':639C '8.19.0':641C '8.20.0':676C '9':281C,376C,431C,520C '9.0.0':643C '9.24.0':645C '9.25.0':677C 'action':366C 'admit':558C 'affect':321C,410C,451C,635C 'ajaxdisablecomponentlisten':424C 'ajaxeditablelabel':422C 'ajaxindicatorappend':423C 'ajaxlistpanel':438C 'also':359C 'ampersand':599C 'angl':594C 'apach':1A,18B,28B,88C,90C,518C,636C,652C 'apache-wicket':17B 'appenddefaultbuttonfield':379C 'applic':61B,170C,213C,449C,478C,507C 'attribut':191C,238C,387C,402C,487C 'backquot':590C 'backslash':49B,155C,592C 'block':75B 'brace':593C 'bracket':595C,614C 'break':50B 'build':440C 'built':126C 'call':300C 'cannot':245C 'carri':460C,541C 'charact':220C,464C,603C 'charsequ':290C,318C 'check':562C 'code':78B,550C 'come':475C 'compon':31B,112C,123C,128C,195C,258C,265C,268C,302C,316C,458C,484C,493C,577C,617C 'construct':618C 'contain':44B,149C,246C,336C,396C,444C,586C,610C 'content':66B,514C 'content-security-polici':65B,513C 'context':145C,217C,504C 'control':602C 'core':279C,307C,421C 'correct':228C 'cve':11A,14A 'data':497C 'default':72B,527C 'deriv':109C,252C,495C 'doubl':398C 'either':247C,615C 'element':98C,241C,540C 'end':156C 'enter':567C 'escap':39B,142C,226C,390C,400C,570C 'everi':320C 'except':632C 'extens':27B,311C,408C 'fail':629C 'field':335C 'filterform':428C 'first':207C 'fix':560C,681C 'follow':161C 'forcompon':315C 'form':122C,261C,264C,358C,378C 'formarkupid':287C 'generat':36B,86C,92C,202C,243C,533C 'given':296C,624C 'hidden':334C 'hidden-field':333C 'host':24B 'html':216C 'id':4A,34B,115C,129C,179C,190C,200C,237C,244C,255C,269C,293C,327C,330C,350C,447C,455C,459C,480C,486C,494C,564C,578C,582C,607C,622C,628C 'improp':79C 'inject':6A,77B,549C 'input':82C,118C,249C,343C,353C,362C,382C 'insid':133C 'instead':568C 'issu':634C,683C 'java':20B 'javascript':37B,93C,105C,137C,443C,503C 'kittencaptchapanel':426C 'legal':222C 'let':5A 'link':370C 'liter':139C,158C,339C 'load':176C 'longer':585C,661C 'markup':33B,114C,178C,197C,326C,349C,404C,446C,454C,581C,606C,627C 'may':583C,608C 'name':119C,250C,344C,354C,363C,383C,386C 'neutral':80C 'nonc':546C 'none':498C 'older':657C 'one':461C,469C 'order':205C 'org.apache.wicket':276C,405C 'org.apache.wicket.component':185C 'org.apache.wicket.markup.head.oneventheaderitem':286C 'org.apache.wicket.markup.html.form.form':323C 'org.apache.wicket.markup.html.form.formcomponentupdatingbehavior':340C 'org.apache.wicket.markup.html.form.upload.multifileuploadfield':346C 'origin':63B,172C 'packag':21B 'page':10A,85C,175C 'palett':427C 'parenthes':611C 'pars':163C 'part':552C 'pass':183C 'per':544C 'per-respons':543C 'place':132C,572C 'point':509C 'polici':68B,516C,557C 'prevent':530C 'put':468C 'quot':47B,136C,152C,291C,399C,588C 'reach':312C 'recommend':671C 'refer':95C 'reject':271C 'render':100C 'respons':545C 'right':414C 'run':8A,56B,167C 'script':7A,58B,165C,534C,539C,555C 'secur':67B,515C 'self':23B 'self-host':22B 'semicolon':597C 'send':70B,525C 'set':481C 'setmarkupid':186C 'singl':46B,135C,151C 'single-quot':134C 'squar':613C 'string':54B,138C,187C,288C,289C,317C 'submit':369C 'suppli':210C 'support':662C,667C 'templat':490C 'trapfocusbehavior':436C 'two':106C,208C,348C 'unescap':3A 'upgrad':664C,673C 'uploadprogressbar':425C 'user':650C,669C 'valu':43B,107C,148C,182C,234C,395C,474C 'version':322C,561C,668C,675C 'view':511C 'web':84C 'wicket':2A,19B,26B,29B,69B,89C,91C,201C,225C,278C,306C,310C,407C,420C,465C,519C,637C,653C 'wicket-cor':277C,305C,419C 'wicket-extens':25B,309C,406C 'wicket.event.add':299C 'without':38B,140C 'write':30B,102C,231C,324C,341C,347C,360C,380C 'written':192C,536C,575C 'x':282C,285C,357C,374C,377C,432C,435C,521C,524C,655C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, or 10.0.0 to 10.11.0 are exposed, and wicket-extensions is affected on its own. Exposure needs a markup id or component id that carries a quote, backslash or other special character, which usually means the value came from data or from application code that sets ids dynamically. Applications on fixed versions, or that never set ids from untrusted input, are lower risk. Wicket 7.x and older are unsupported and should be upgraded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T23:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95863","severity":null,"published_at":"2026-11-01T23:17:30+00:00","modified_at":"2026-11-01T23:17:30+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}