Input Neutralization Vulnerability in Apache Wicket Affecting Multiple Versions

CVE-2026-82956

What is CVE-2026-82956?

The vulnerability arises from improper handling of the 'window.name' parameter during web page generation in Apache Wicket's AjaxNewWindowNotifyingBehavior. When a page instance is opened in a new tab or window, the application captures the client-supplied value of 'window.name' without sufficient validation. This can lead to JavaScript injection if the value contains a single quote, thus allowing unauthorized scripts to execute within the application's context. Importantly, this risk exists only for applications that explicitly implement the AjaxNewWindowNotifyingBehavior, as it is not a default feature of the framework itself. Users are urged to upgrade to the latest versions to mitigate the vulnerability.

References