{"cve":"CVE-2026-111089","nvd":{"published":"2026-11-01T23:17:28.697","modified":"2026-11-01T23:17:28.697","status":"Received","description":"Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads.\n\nA resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script.\n\nIn org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. It does prevent an inline event handler injected through the attribute cases.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6},"cvss_v3":null,"cwes":["CWE-79"],"references":["https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8"],"reference_tags":[{"url":"https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8","tags":[]}],"products":[],"affected":[],"source":"nvd","synced_at":"2026-11-01T23:36:13.294661700+00:00"},"epss":null,"kev":null,"exploits":[],"weaknesses":[{"name":"Improper Neutralization of Input During Web Page Generation","common_name":"Cross-site Scripting","deprecated":false,"replaced_by":[],"id":"CWE-79"}],"osv":[],"fixed":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program.","Public exploits: links to the Exploit Database (https://www.exploit-db.com, by OffSec; index under GPL-2.0), Rapid7's Metasploit Framework modules (https://github.com/rapid7/metasploit-framework, BSD-3-Clause) and ProjectDiscovery's nuclei templates (https://github.com/projectdiscovery/nuclei-templates, MIT). Only the links, titles and dates are stored; no exploit code is fetched or served.","CWE names and descriptions: MITRE's Common Weakness Enumeration (https://cwe.mitre.org), Copyright © 2006–2026, The MITRE Corporation, under the CWE terms of use (https://cwe.mitre.org/about/termsofuse.html). CWE is a trademark of The MITRE Corporation."]}