CVE-2026-95863
📛 CVE Title
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
Description
Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from component ids. Both are placed inside single-quoted JavaScript string literals without being escaped for that context, so a value containing a single quote or a backslash ends the literal, and what follows is parsed as script and runs in the application's origin when the page loads. A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String), or the id attribute written in the component's markup, or an id Wicket generates, in that order. The first two are supplied by the application in an HTML context, where both characters are legal and where Wicket escapes them correctly when it writes the same value into the id attribute of the element; a generated id cannot contain either. An input name is derived from the ids of the components between the form and the form component, and a component id was rejected only for ':' and '~'. In org.apache.wicket:wicket-core on 9.x and 10.x, org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String, CharSequence) quotes the id it is given into a Wicket.Event.add call, and components in both wicket-core and wicket-extensions reach it through #forComponent(Component, String, CharSequence). On every affected version, org.apache.wicket.markup.html.form.Form writes its markup id and the id of its hidden-fields container into such literals, org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes two markup ids and an input name. On 8.x, Form also writes an input name into the action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField writes an input name into a name attribute with no escaping at all, so a value containing a double quote escapes the attribute into markup. org.apache.wicket:wicket-extensions is affected in its own right and not only through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender, AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette, FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build their own JavaScript containing a markup id. An application is affected where a markup id or a component id carries one of those characters. Wicket does not put one there itself, so the value comes from the application: an id set on a component, an id attribute in a template, or a component id derived from data. None of those is a JavaScript context from the application's point of view. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent this. The generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. The fixed versions check an id where it enters instead of escaping each place it is written. A component id and a markup id may no longer contain a quote, a backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a control character, and a markup id may not contain parentheses or square brackets either; a component constructed with such an id, or given such a markup id, fails with an exception. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- apache
- CVSS severity
- HIGH
- CVSS score
- 7.6 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Effective score
- 7.6 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-09-22
- Published
- 2026-11-01 22:30 UTC
- Last updated
- 2026-11-01 22:30 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95863.json
- Linked Threat
- CVE-2026-95863 — Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-11-01 23:17:30 UTC
- NVD last modified
- 2026-11-01 23:17:30 UTC
NVD / KEV / EPSS data refreshed 2026-11-02 13:51 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-114903 - Assigner
- apache
- Published
- Nov 1, 2026, 10:30:47 PM
- Updated
- Nov 1, 2026, 10:30:47 PM
- EUVD base score (CVSS 4.0)
-
7.6 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0000
- Vendors
- Apache Software Foundation
- Products
-
Apache Wicket (10.0.0 ≤10.11.0)Apache Wicket (8.0.0 ≤8.19.0)Apache Wicket (9.0.0 ≤9.24.0)
- Aliases
-
GHSA-f4x7-9w8x-8x82
ENISA description: Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from component ids. Both are placed inside single-quoted JavaScript string literals without being escaped for that context, so a value containing a single quote or a backslash ends the literal, and what follows is parsed as script and runs in the application's origin when the page loads. A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String), or the id attribute written in the component's markup, or an id Wicket generates, in that order. The first two are supplied by the application in an HTML context, where both characters are legal and where Wicket escapes them correctly when it writes the same value into the id attribute of the element; a generated id cannot contain either. An input name is derived from the ids of the components between the form and the form component, and a component id was rejected only for ':' and '~'. In org.apache.wicket:wicket-core on 9.x and 10.x, org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String, CharSequence) quotes the id it is given into a Wicket.Event.add call, and components in both wicket-core and wicket-extensions reach it through #forComponent(Component, String, CharSequence). On every affected version, org.apache.wicket.markup.html.form.Form writes its markup id and the id of its hidden-fields container into such literals, org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes two markup ids and an input name. On 8.x, Form also writes an input name into the action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField writes an input name into a name attribute with no escaping at all, so a value containing a double quote escapes the attribute into markup. org.apache.wicket:wicket-extensions is affected in its own right and not only through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender, AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette, FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build their own JavaScript containing a markup id. An application is affected where a markup id or a component id carries one of those characters. Wicket does not put one there itself, so the value comes from the application: an id set on a component, an id attribute in a template, or a component id derived from data. None of those is a JavaScript context from the application's point of view. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent this. The generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. The fixed versions check an id where it enters instead of escaping each place it is written. A component id and a markup id may no longer contain a quote, a backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a control character, and a markup id may not contain parentheses or square brackets either; a component constructed with such an id, or given such a markup id, fails with an exception. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Apache Software Foundation | Apache Wicket |
8.0.0 (affected),
9.0.0 (affected),
10.0.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v security@apache.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blogs.oracle.com
For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-02 11:27 UTC -
web:cvetodo.com
CVE-2026-95863 is a CVSS 7.6 Cross-Site Scripting (XSS) vulnerability in Apache Wicket. Includes technical details, affected versions, and mitigation steps.
2026-11-02 11:27 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-02 11:27 UTC -
web:learn.microsoft.com
In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...
2026-11-02 11:27 UTC -
web:patchmypc.com
You can find the production release history below for 2026 . View the 2025 Catalog Release History.
2026-11-02 11:27 UTC -
web:support.okta.com
Review the latest Okta security advisories and apply necessary product updates to maintain a secure identity environment.
2026-11-02 11:27 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-11-02 11:27 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-11-02 11:27 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-11-02 11:27 UTC -
web:www.rapid7.com
Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. This is by far the most CVEs that Microsoft has ever published in a single day.
2026-11-02 11:27 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-95863.json.
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.wicket:wicket-core",
"packageURL": "pkg:maven/org.apache.wicket/wicket-core",
"product": "Apache Wicket",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "8.19.0",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.24.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.0",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pedro Santos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation in Apache Wicket.<br><br>Apache Wicket generates JavaScript that refers to the elements it renders, and<br>writes into that JavaScript two values it derives itself: a component's markup<br>id, and the input name of a form component, which is built from component ids.<br>Both are placed inside single-quoted JavaScript string literals without being<br>escaped for that context, so a value containing a single quote or a backslash<br>ends the literal, and what follows is parsed as script and runs in the<br>application's origin when the page loads.<br><br>A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),<br>or the id attribute written in the component's markup, or an id Wicket<br>generates, in that order. The first two are supplied by the application in an<br>HTML context, where both characters are legal and where Wicket escapes them<br>correctly when it writes the same value into the id attribute of the element; a<br>generated id cannot contain either. An input name is derived from the ids of the<br>components between the form and the form component, and a component id was<br>rejected only for ':' and '~'.<br><br>In org.apache.wicket:wicket-core on 9.x and 10.x,<br>org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,<br>CharSequence) quotes the id it is given into a Wicket.Event.add call, and<br>components in both wicket-core and wicket-extensions reach it through<br>#forComponent(Component, String, CharSequence). On every affected version,<br>org.apache.wicket.markup.html.form.Form writes its markup id and the id of its<br>hidden-fields container into such literals,<br>org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input<br>name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes<br>two markup ids and an input name. On 8.x, Form also writes an input name into the<br>action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField<br>writes an input name into a name attribute with no escaping at all, so a value<br>containing a double quote escapes the attribute into markup.<br><br>org.apache.wicket:wicket-extensions is affected in its own right and not only<br>through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,<br>AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,<br>FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build<br>their own JavaScript containing a markup id.<br><br>An application is affected where a markup id or a component id carries one of<br>those characters. Wicket does not put one there itself, so the value comes from<br>the application: an id set on a component, an id attribute in a template, or a<br>component id derived from data. None of those is a JavaScript context from the<br>application's point of view.<br><br>The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does<br>not prevent this. The generated script is written into a script element carrying<br>the per-response nonce, so the injected code is part of a script the policy<br>admits.<br><br>The fixed versions check an id where it enters instead of escaping each place it<br>is written. A component id and a markup id may no longer contain a quote, a<br>backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a<br>control character, and a markup id may not contain parentheses or square<br>brackets either; a component constructed with such an id, or given such a markup<br>id, fails with an exception.<br><br>This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through<br>9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which<br>are no longer supported, should upgrade to a supported version. Users are<br>recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."
}
],
"value": "Improper neutralization of input during web page generation in Apache Wicket.\n\nApache Wicket generates JavaScript that refers to the elements it renders, and\nwrites into that JavaScript two values it derives itself: a component's markup\nid, and the input name of a form component, which is built from component ids.\nBoth are placed inside single-quoted JavaScript string literals without being\nescaped for that context, so a value containing a single quote or a backslash\nends the literal, and what follows is parsed as script and runs in the\napplication's origin when the page loads.\n\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),\nor the id attribute written in the component's markup, or an id Wicket\ngenerates, in that order. The first two are supplied by the application in an\nHTML context, where both characters are legal and where Wicket escapes them\ncorrectly when it writes the same value into the id attribute of the element; a\ngenerated id cannot contain either. An input name is derived from the ids of the\ncomponents between the form and the form component, and a component id was\nrejected only for ':' and '~'.\n\nIn org.apache.wicket:wicket-core on 9.x and 10.x,\norg.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,\nCharSequence) quotes the id it is given into a Wicket.Event.add call, and\ncomponents in both wicket-core and wicket-extensions reach it through\n#forComponent(Component, String, CharSequence). On every affected version,\norg.apache.wicket.markup.html.form.Form writes its markup id and the id of its\nhidden-fields container into such literals,\norg.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input\nname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes\ntwo markup ids and an input name. On 8.x, Form also writes an input name into the\naction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField\nwrites an input name into a name attribute with no escaping at all, so a value\ncontaining a double quote escapes the attribute into markup.\n\norg.apache.wicket:wicket-extensions is affected in its own right and not only\nthrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,\nAjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,\nFilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build\ntheir own JavaScript containing a markup id.\n\nAn application is affected where a markup id or a component id carries one of\nthose characters. Wicket does not put one there itself, so the value comes from\nthe application: an id set on a component, an id attribute in a template, or a\ncomponent id derived from data. None of those is a JavaScript context from the\napplication's point of view.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does\nnot prevent this. The generated script is written into a script element carrying\nthe per-response nonce, so the injected code is part of a script the policy\nadmits.\n\nThe fixed versions check an id where it enters instead of escaping each place it\nis written. A component id and a markup id may no longer contain a quote, a\nbackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a\ncontrol character, and a markup id may not contain parentheses or square\nbrackets either; a component constructed with such an id, or given such a markup\nid, fails with an exception.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through\n9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which\nare no longer supported, should upgrade to a supported version. Users are\nrecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T22:30:47.259Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-95863",
"datePublished": "2026-11-01T22:30:47.259Z",
"dateReserved": "2026-09-22T16:47:16.652Z",
"dateUpdated": "2026-11-01T22:30:47.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}