Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.

Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Published: 2026-07-27
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of input during web page generation in Apache Wicket permits an attacker to craft link URLs that escape the surrounding JavaScript context and inject arbitrary JavaScript. The injected script runs in the victim’s browser as the user who clicks the link, enabling phishing, credential theft, session hijacking or defacement of the affected page. This issue is a classic Cross‑Site Scripting flaw.

Affected Systems

Any installation of Apache Wicket version 9.0.0 through 9.23.0 or 10.0.0 through 10.9.0 is vulnerable. These releases are commonly embedded in Java web applications and service components that generate HTML containing user‑controlled links.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate risk. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a currently low‑to‑moderate exploitation probability. The attack vector is inferred to be a user clicking a crafted link within a vulnerable page; full exploitation requires the user’s browser to process the injected JavaScript, so the threat is limited to end users who interact with the affected content.

Generated by OpenCVE AI on August 3, 2026 at 17:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Wicket to version 10.10.0 or later, which fixes the XSS flaw.
  • If an upgrade is not yet possible, enforce strict URI validation and encoding for all user‑provided link URLs before rendering them in JavaScript contexts to prevent injection.
  • Implement a Content Security Policy that disallows inline scripts and restricts script sources to trusted domains, mitigating the impact of any injected JavaScript.

Generated by OpenCVE AI on August 3, 2026 at 17:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache wicket
Vendors & Products Apache
Apache wicket
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Title Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
Weaknesses CWE-79
References

Subscriptions

Apache Wicket
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-28T14:49:16.289Z

Reserved: 2026-07-25T22:06:33.013Z

Link: CVE-2026-66390

cve-icon Vulnrichment

Updated: 2026-07-27T18:32:02.845Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T17:16:41.643

Modified: 2026-08-05T18:43:40.290

Link: CVE-2026-66390

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:15:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')