Description
Improper neutralization of input during web page generation in Apache Wicket.

The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no escaping setting at all, so markup in a label is rendered as markup.

When the label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application.

There is no workaround. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped.

The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label.

This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Published: 2026-08-31
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs in Apache Wicket's AutoLabelTextResolver, which places the label text directly into the rendered markup without escaping. When an application sets a component's label via FormComponent.setLabel(IModel) using data that can be influenced by an attacker, the unescaped content is served to the browser as raw HTML or script. This flaw is a cross‑site scripting (CWE‑79) weakness that allows arbitrary client‑side code execution in the context of the application.

Affected Systems

Affected products are Apache Wicket applications running versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0, as well as older unsupported releases from 1.5.0 onward. The problem exists in the default configuration of every WebApplication because AutoLabelTextResolver is registered automatically. All applications that use setLabel with potentially user‑controlled data are vulnerable.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw from the client side by causing the browser to execute the injected script. Once an attacker controls the label model, the XSS can lead to session hijacking, phishing, or data exfiltration.

Generated by OpenCVE AI on August 31, 2026 at 13:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the patched versions of Apache Wicket: 8.19.0, 9.24.0, or 10.11.0 (or later). This rectifies the unsafe label rendering logic.
  • Audit the codebase to locate any FormComponent.setLabel calls that receive data from user input; if such calls must remain, sanitize or escape the input before assigning it to the label.
  • While an upgrade is pending, avoid setting component labels from untrusted data or replace them with static strings; alternatively apply a custom label resolver that performs escaping, but note that such a workaround is not formally supported by the vendor.

Generated by OpenCVE AI on August 31, 2026 at 13:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
References

Mon, 31 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no escaping setting at all, so markup in a label is rendered as markup. When the label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. There is no workaround. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped. The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Title Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Amber'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-31T12:16:46.955Z

Reserved: 2026-08-20T06:50:42.261Z

Link: CVE-2026-76983

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T12:17:57.297

Modified: 2026-08-31T13:18:25.897

Link: CVE-2026-76983

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T13:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')