CVE-2026-76985— Apache Wicket: XSS in Palette via getAdditionalAttributes
Quick assessment
Affected
Apache Software Foundation Apache Wicket
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache Wicket 中生成网页时，输入未得到适当中和（即输入校验/转义处理不当）。 具体而言， 负责渲染 Palette 中的两个选项列表。该组件会根据 的设置对每个选项的 ID 和显示值进行转义处理，但会将 返回的属性名和属性值原样写入 标签中，而未做转义或过滤。 当应用重写了 、 或 方法，并返回一个包含攻击者可控制的数据时，该应用将受到影响。由于这些方法默认返回 ，因此未重写它们的应用不受影响。 作为临时解决方案，可在重写方法中对返回值进行转义处理。 此问题影响以下 Apache Wicket 版
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Wicket: XSS in Palette via getAdditionalAttributes
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the <option> tag as they came.
An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected.
As a workaround, escape the values in the override.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Green
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Wicket | 8.0.0 ~ 8.18.0 | - |
|
II. Public POCs for CVE-2026-76985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76985
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-76985 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-31 · 10 CVEs total
| CVE-2026-58301 | 5.9 MEDIUM | Apache Shiro: Server-side POST request may be steered to an alternate host |
| CVE-2026-76983 | 5.1 MEDIUM | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel |
| CVE-2026-76984 | 5.1 MEDIUM | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute |
| CVE-2026-76982 | 5.1 MEDIUM | Apache Wicket: XSS in Button via its model object |
| CVE-2026-75802 | 5.1 MEDIUM | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and default |
| CVE-2026-76986 | Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue | |
| CVE-2026-71378 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationReq | |
| CVE-2026-71257 | Apache Wicket: Configured file upload limits are not enforced when the multipart request h | |
| CVE-2026-70449 | Apache Wicket: Path traversal in resource style/variation/locale |
IV. Related Vulnerabilities
Same product: Apache Wicket
-
CVE-2026-76986
Apache Wicket: XSS in AbstractSingleSelectChoice via getNull -
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v
Same vendor: Apache Software Foundation
-
CVE-2026-76986
Apache Wicket: XSS in AbstractSingleSelectChoice via getNull -
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen -
CVE-2026-76984
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute -
CVE-2026-76982
Apache Wicket: XSS in Button via its model object -
CVE-2026-75802
Apache Wicket: XSS in AjaxEditableLabel and its subclasses v
Same weakness: CWE-79
-
CVE-2026-82805
Typora Mermaid Rendering cross site scripting -
CVE-2026-82700
code-projects Online Shopping System Newsletter Subscription -
CVE-2026-78077
Joomla Extension - joomshaper.com - Stored Cross-Site Scrip -
CVE-2026-76986
Apache Wicket: XSS in AbstractSingleSelectChoice via getNull -
CVE-2026-76983
Apache Wicket: XSS in AutoLabelTextResolver via FormComponen
V. Comments for CVE-2026-76985
No comments yet