Input Handling Vulnerability in Apache Wicket Web Framework
CVE-2026-84231

7.4HIGH

Key Information:

Vendor

Apache
Status
Apache Wicket
Vendor
CVE Published:
1 November 2026

What is CVE-2026-84231?

A vulnerability exists in Apache Wicket's handling of web page generation, specifically within the org.apache.wicket.markup.html.link.ExternalLink component. The framework improperly neutralizes input when concatenating URLs into JavaScript handlers. This flaw allows an attacker to execute arbitrary JavaScript in the application's context if a user interacts with a bound markup tag that isn't an anchor element. Users are advised to upgrade to version 8.20.0 or later to mitigate this risk.

Affected Version(s)

Apache Wicket 8.0.0 <= 8.19.0

References

https://lists.apache.org/thread.html/39kz9838w25797bpkxn1...
vendor-advisory

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emond Papegaaij
.