Input Neutralization Flaw in Apache Wicket Web Framework

CVE-2026-95863

What is CVE-2026-95863?

A vulnerability exists in Apache Wicket where improper neutralization of input can lead to JavaScript injection during web page generation. When Wicket renders web components, it dynamically generates JavaScript that utilizes values for markup IDs and input names derived from user-supplied inputs. If these values include unescaped characters like single quotes or backslashes, they can prematurely terminate JavaScript string literals, resulting in an execution of unintended scripts when the page loads. This poses significant risks as it bypasses content security policies that should prevent such actions. The issue affects several versions of Wicket and is crucial for developers to address by upgrading to the latest fixed versions to mitigate security threats.

References