CVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

[Emond Papegaaij <papegaaij () apache org>]

Severity: moderate 

Affected versions:

- Apache Wicket (org.apache.wicket:wicket-core) 8.0.0 through 8.18.0
- Apache Wicket (org.apache.wicket:wicket-core) 9.0.0 through 9.23.0
- Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.10.0

Description:

Improper neutralization of input during web page generation in Apache Wicket.

org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute 
names it wrote, but ran the attribute values through a replacement of " with \". A backslash before a double quote 
means nothing in HTML, so a value containing a double quote ends its own attribute and what follows is parsed as 
further attributes of the generated tag.

An application is affected where it supplies an attribute value holding data an attacker can influence, through 
addTagAttribute or the forMetaTag and forLinkTag factory methods. A value may be given as an IModel, so it is not 
necessarily a literal.

There is no setting to change; an application can only avoid supplying a value that contains a double quote. Note that 
these values have never been escaped effectively: before the change released in 6.24.0, 7.4.0 and 8.0.0 they were 
written with no escaping at all.

This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. 
Older, unsupported releases from 6.17.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 
9.24.0 or 10.11.0, which fix the issue.

Credit:

Emond Papegaaij (finder)

References:

https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-76984