Cross-Site Scripting Vulnerability in Apache Wicket by The Apache Software Foundation

CVE-2026-111089

What is CVE-2026-111089?

This vulnerability in Apache Wicket allows attackers to inject malicious scripts into web applications by improperly escaping text from resource bundles. When localized text containing certain characters, like quotes or apostrophes, is written into JavaScript string literals or HTML attributes, it can lead to potentially harmful script execution within the application context. Compromised resource entries can result in unauthorized code running in users' browsers, making it critical for upgrades to secure versions like 8.20.0, 9.25.0, or 10.12.0, as older versions are no longer supported.

References