HTML Injection Vulnerability in Apache Wicket Components

CVE-2026-75802

What is CVE-2026-75802?

The AjaxEditableChoiceLabel component in Apache Wicket is susceptible to an HTML injection flaw due to improper handling of user-rendered data. When integrated with a non-null IChoiceRenderer, the display value can be directly written into the label's markup without the essential HTML escaping, which exposes users to potential cross-site scripting (XSS) attacks. This vulnerability is particularly concerning as it permits malicious users to manipulate choice or model data, injecting harmful scripts that can execute in the browsers of unsuspecting visitors. Despite other areas of the system applying necessary escapes, the label rendering process remains unprotected, prompting an urgent need for users to upgrade to the latest patched versions.

References