CVE-2026-76984— Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
Quick assessment
Affected
Apache Software Foundation Apache Wicket
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Wicket 在生成网页时对输入未进行适当的中性化处理（即输入未得到充分净化）。 用于生成 和 头部标签。该类在写入属性名时进行了转义处理，但对属性值仅执行了将双引号 替换为反斜杠转义形式 。然而在 HTML 中，双引号前的反斜杠并无特殊含义，因此如果属性值中包含双引号，它会提前结束当前属性，导致后续内容被解析为同一标签的额外属性，从而可能引发跨站脚本（XSS）等安全问题。 当应用程序通过 方法或 和 工厂方法提供了攻击者可以影响的属性值时，该应用将受到影响。由于属性值可以以 对象形式提供，因此其内容
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76984
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with \". A backslash before a double quote means nothing in HTML, so a value containing a double quote ends its own attribute and what follows is parsed as further attributes of the generated tag.
An application is affected where it supplies an attribute value holding data an attacker can influence, through addTagAttribute or the forMetaTag and forLinkTag factory methods. A value may be given as an IModel, so it is not necessarily a literal.
There is no setting to change; an application can only avoid supplying a value that contains a double quote. Note that these values have never been escaped effectively: before the change released in 6.24.0, 7.4.0 and 8.0.0 they were written with no escaping at all.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.17.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Wicket | 8.0.0 ~ 8.18.0 | - |
|
II. Public POCs for CVE-2026-76984
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76984
请登录查看更多情报信息。
Other References for CVE-2026-76984 (1)
-
https://lists.apache.org/thread/jt8yxntfjcxnnntth1qjtdo19gzx5n6v vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-08-31 · 8 CVEs total
| CVE-2026-58301 | 5.9 MEDIUM | Apache Shiro: Server-side POST request may be steered to an alternate host |
| CVE-2026-76983 | 5.1 MEDIUM | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel |
| CVE-2026-76982 | 5.1 MEDIUM | Apache Wicket: XSS in Button via its model object |
| CVE-2026-75802 | 5.1 MEDIUM | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and default |
| CVE-2026-71378 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationReq | |
| CVE-2026-71257 | Apache Wicket: Configured file upload limits are not enforced when the multipart request h | |
| CVE-2026-70449 | Apache Wicket: Path traversal in resource style/variation/locale |
IV. Related Vulnerabilities
Same product: Apache Wicket
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-71378
Apache Wicket: Cross-Site Request Forgery (CSRF) protection -
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforce
Same vendor: Apache Software Foundation
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-71378
Apache Wicket: Cross-Site Request Forgery (CSRF) protection -
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforce
Same weakness: CWE-79
-
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v -
CVE-2026-82881
Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdow -
CVE-2026-82868
@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG
V. Comments for CVE-2026-76984
No comments yet