CVE-2026-95863

*** Pendiente de traducción *** Improper neutralization of input during web page generation in Apache Wicket.<br /> <br /> Apache Wicket generates JavaScript that refers to the elements it renders, and<br /> writes into that JavaScript two values it derives itself: a component&amp;#39;s markup<br /> id, and the input name of a form component, which is built from component ids.<br /> Both are placed inside single-quoted JavaScript string literals without being<br /> escaped for that context, so a value containing a single quote or a backslash<br /> ends the literal, and what follows is parsed as script and runs in the<br /> application&amp;#39;s origin when the page loads.<br /> <br /> A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),<br /> or the id attribute written in the component&amp;#39;s markup, or an id Wicket<br /> generates, in that order. The first two are supplied by the application in an<br /> HTML context, where both characters are legal and where Wicket escapes them<br /> correctly when it writes the same value into the id attribute of the element; a<br /> generated id cannot contain either. An input name is derived from the ids of the<br /> components between the form and the form component, and a component id was<br /> rejected only for &amp;#39;:&amp;#39; and &amp;#39;~&amp;#39;.<br /> <br /> In org.apache.wicket:wicket-core on 9.x and 10.x,<br /> org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,<br /> CharSequence) quotes the id it is given into a Wicket.Event.add call, and<br /> components in both wicket-core and wicket-extensions reach it through<br /> #forComponent(Component, String, CharSequence). On every affected version,<br /> org.apache.wicket.markup.html.form.Form writes its markup id and the id of its<br /> hidden-fields container into such literals,<br /> org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input<br /> name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes<br /> two markup ids and an input name. On 8.x, Form also writes an input name into the<br /> action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField<br /> writes an input name into a name attribute with no escaping at all, so a value<br /> containing a double quote escapes the attribute into markup.<br /> <br /> org.apache.wicket:wicket-extensions is affected in its own right and not only<br /> through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,<br /> AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,<br /> FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build<br /> their own JavaScript containing a markup id.<br /> <br /> An application is affected where a markup id or a component id carries one of<br /> those characters. Wicket does not put one there itself, so the value comes from<br /> the application: an id set on a component, an id attribute in a template, or a<br /> component id derived from data. None of those is a JavaScript context from the<br /> application&amp;#39;s point of view.<br /> <br /> The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does<br /> not prevent this. The generated script is written into a script element carrying<br /> the per-response nonce, so the injected code is part of a script the policy<br /> admits.<br /> <br /> The fixed versions check an id where it enters instead of escaping each place it<br /> is written. A component id and a markup id may no longer contain a quote, a<br /> backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a<br /> control character, and a markup id may not contain parentheses or square<br /> brackets either; a component constructed with such an id, or given such a markup<br /> id, fails with an exception.<br /> <br /> This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through<br /> 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which<br /> are no longer supported, should upgrade to a supported version. Users are<br /> recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.