{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-95863",
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "state": "PUBLISHED",
        "assignerShortName": "apache",
        "dateReserved": "2026-09-22T16:47:16.652Z",
        "datePublished": "2026-11-01T22:30:47.259Z",
        "dateUpdated": "2026-11-01T22:30:47.259Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
                "shortName": "apache",
                "dateUpdated": "2026-11-01T22:30:47.259Z"
            },
            "title": "Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
                            "lang": "en",
                            "cweId": "CWE-79",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "source": {
                "discovery": "INTERNAL"
            },
            "affected": [
                {
                    "vendor": "Apache Software Foundation",
                    "product": "Apache Wicket",
                    "packageURL": "pkg:maven/org.apache.wicket/wicket-core",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "8.0.0",
                            "lessThanOrEqual": "8.19.0",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "9.0.0",
                            "lessThanOrEqual": "9.24.0",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "10.0.0",
                            "lessThanOrEqual": "10.11.0",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "org.apache.wicket:wicket-core"
                }
            ],
            "descriptions": [
                {
                    "value": "Improper neutralization of input during web page generation in Apache Wicket.\n\nApache Wicket generates JavaScript that refers to the elements it renders, and\nwrites into that JavaScript two values it derives itself: a component's markup\nid, and the input name of a form component, which is built from component ids.\nBoth are placed inside single-quoted JavaScript string literals without being\nescaped for that context, so a value containing a single quote or a backslash\nends the literal, and what follows is parsed as script and runs in the\napplication's origin when the page loads.\n\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),\nor the id attribute written in the component's markup, or an id Wicket\ngenerates, in that order. The first two are supplied by the application in an\nHTML context, where both characters are legal and where Wicket escapes them\ncorrectly when it writes the same value into the id attribute of the element; a\ngenerated id cannot contain either. An input name is derived from the ids of the\ncomponents between the form and the form component, and a component id was\nrejected only for ':' and '~'.\n\nIn org.apache.wicket:wicket-core on 9.x and 10.x,\norg.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,\nCharSequence) quotes the id it is given into a Wicket.Event.add call, and\ncomponents in both wicket-core and wicket-extensions reach it through\n#forComponent(Component, String, CharSequence). On every affected version,\norg.apache.wicket.markup.html.form.Form writes its markup id and the id of its\nhidden-fields container into such literals,\norg.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input\nname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes\ntwo markup ids and an input name. On 8.x, Form also writes an input name into the\naction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField\nwrites an input name into a name attribute with no escaping at all, so a value\ncontaining a double quote escapes the attribute into markup.\n\norg.apache.wicket:wicket-extensions is affected in its own right and not only\nthrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,\nAjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,\nFilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build\ntheir own JavaScript containing a markup id.\n\nAn application is affected where a markup id or a component id carries one of\nthose characters. Wicket does not put one there itself, so the value comes from\nthe application: an id set on a component, an id attribute in a template, or a\ncomponent id derived from data. None of those is a JavaScript context from the\napplication's point of view.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does\nnot prevent this. The generated script is written into a script element carrying\nthe per-response nonce, so the injected code is part of a script the policy\nadmits.\n\nThe fixed versions check an id where it enters instead of escaping each place it\nis written. A component id and a markup id may no longer contain a quote, a\nbackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a\ncontrol character, and a markup id may not contain parentheses or square\nbrackets either; a component constructed with such an id, or given such a markup\nid, fails with an exception.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through\n9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which\nare no longer supported, should upgrade to a supported version. Users are\nrecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.",
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Improper neutralization of input during web page generation in Apache Wicket.<br><br>Apache Wicket generates JavaScript that refers to the elements it renders, and<br>writes into that JavaScript two values it derives itself: a component's markup<br>id, and the input name of a form component, which is built from component ids.<br>Both are placed inside single-quoted JavaScript string literals without being<br>escaped for that context, so a value containing a single quote or a backslash<br>ends the literal, and what follows is parsed as script and runs in the<br>application's origin when the page loads.<br><br>A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),<br>or the id attribute written in the component's markup, or an id Wicket<br>generates, in that order. The first two are supplied by the application in an<br>HTML context, where both characters are legal and where Wicket escapes them<br>correctly when it writes the same value into the id attribute of the element; a<br>generated id cannot contain either. An input name is derived from the ids of the<br>components between the form and the form component, and a component id was<br>rejected only for ':' and '~'.<br><br>In org.apache.wicket:wicket-core on 9.x and 10.x,<br>org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,<br>CharSequence) quotes the id it is given into a Wicket.Event.add call, and<br>components in both wicket-core and wicket-extensions reach it through<br>#forComponent(Component, String, CharSequence). On every affected version,<br>org.apache.wicket.markup.html.form.Form writes its markup id and the id of its<br>hidden-fields container into such literals,<br>org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input<br>name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes<br>two markup ids and an input name. On 8.x, Form also writes an input name into the<br>action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField<br>writes an input name into a name attribute with no escaping at all, so a value<br>containing a double quote escapes the attribute into markup.<br><br>org.apache.wicket:wicket-extensions is affected in its own right and not only<br>through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,<br>AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,<br>FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build<br>their own JavaScript containing a markup id.<br><br>An application is affected where a markup id or a component id carries one of<br>those characters. Wicket does not put one there itself, so the value comes from<br>the application: an id set on a component, an id attribute in a template, or a<br>component id derived from data. None of those is a JavaScript context from the<br>application's point of view.<br><br>The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does<br>not prevent this. The generated script is written into a script element carrying<br>the per-response nonce, so the injected code is part of a script the policy<br>admits.<br><br>The fixed versions check an id where it enters instead of escaping each place it<br>is written. A component id and a markup id may no longer contain a quote, a<br>backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a<br>control character, and a markup id may not contain parentheses or square<br>brackets either; a component constructed with such an id, or given such a markup<br>id, fails with an exception.<br><br>This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through<br>9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which<br>are no longer supported, should upgrade to a supported version. Users are<br>recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v",
                    "tags": [
                        "vendor-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "format": "CVSS",
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "attackRequirements": "PRESENT",
                        "privilegesRequired": "NONE",
                        "userInteraction": "PASSIVE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "HIGH",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "HIGH",
                        "baseScore": 7.6,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
                    }
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Pedro Santos",
                    "type": "finder"
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 1.0.3"
            }
        }
    }
}