Input Neutralization Flaw in Apache Wicket's Palette Component

CVE-2026-76985

What is CVE-2026-76985?

A vulnerability exists in Apache Wicket's Palette component due to improper neutralization of user input when generating web pages. Specifically, the issue arises in methods like Palette.getAdditionalAttributesForChoices and Palette.getAdditionalAttributesForSelection, where applications that override these methods could return unescaped values influenced by an attacker. By default, these methods return null, offering some protection. However, if overridden carelessly, it can lead to security risks. To mitigate this vulnerability, it is recommended that users upgrade to fixed versions 8.19.0, 9.24.0, or 10.11.0, or ensure proper escaping of values in their overrides.

References