Improper Output Encoding in Apache Wicket Products
CVE-2026-83559

7.4HIGH

Key Information:

Vendor

Apache
Status
Apache Wicket
Vendor
CVE Published:
1 November 2026

What is CVE-2026-83559?

The vulnerability in Apache Wicket stems from improper encoding or escaping of output when using the JavaScriptUtils#escapeQuotes() method. This flaw allows an attacker to inject malicious JavaScript into applications when untrusted data is improperly handled. Specifically, the method fails to escape backslashes, leading to potential JavaScript injection vulnerabilities in web applications using affected versions of Wicket. Applications should immediately upgrade to the fixed versions to safeguard against this security risk.

Affected Version(s)

Apache Wicket 8.0.0 <= 8.19.0

Apache Wicket 9.0.0 <= 9.24.0

Apache Wicket 10.0.0 <= 10.11.0

References

https://lists.apache.org/thread.html/77kc85ztkxdpp7wg7cv6...
vendor-advisory

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emond Papegaaij
.