Improper Input Neutralization in Apache Wicket Affects Multiple Versions

CVE-2026-76983

What is CVE-2026-76983?

The vulnerability arises from inadequate handling of input in Apache Wicket's wicket:label tag, where labels may include unescaped markup from user influence. As the tag's content derives directly from Model data without any escaping mechanism, it creates potential for malicious content to render in the web application. Affected applications that do not properly sanitize input could expose users to various attacks, including Cross-Site Scripting (XSS). Users should upgrade to the recommended versions to secure their applications against this issue.

References