Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every other option body in the same select is escaped according to the escape-model-strings setting. The body comes from getNullValidDisplayValue() or getNullKeyDisplayValue(), both of which are protected, so what they return is not necessarily the plain text the default implementation reads from a resource bundle. An application is affected where it overrides one of those methods and returns a value holding data an attacker can influence, or where its own nullValid or null bundle entry holds such a value. The bundles shipped with Wicket contain plain text. RadioChoice overrides getDefaultChoice to emit no default option and is not affected. As a workaround, escape the value in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-31T14:17:23.497Z",
  "pubdate": "2026-08-31T14:17:23.497Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Apache Wicket due to improper neutralization of input during web page generation.\nThe vulnerability resides within the AbstractSingleSelectChoice class, which improperly handles the rendering of default null-selection options in select components.\nAn attacker capable of influencing the return values of getNullValidDisplayValue() or getNullKeyDisplayValue() can inject arbitrary HTML or JavaScript into the rendered page.\nThe impact includes unauthorized execution of scripts in the context of the victim's session, potentially leading to session hijacking, data exfiltration, or defacement.\nAffected products include Apache Wicket versions 8.x, 9.x, and 10.x, as well as legacy versions dating back to 1.5.0.\nThe flaw stems from a discrepancy in the rendering logic where the default option body bypasses the standard escape-model-strings mechanism applied to other option elements.",
  "technicalDetails": "The root cause of this vulnerability is an inconsistent implementation of input sanitization within the org.apache.wicket.markup.html.form.AbstractSingleSelectChoice class. While Wicket generally enforces the escape-model-strings configuration for choice elements to prevent XSS, the component fails to apply this same escaping logic to the default 'null' option (the prompt text displayed when no selection is active).\nThe default option body is sourced from the protected methods getNullValidDisplayValue() or getNullKeyDisplayValue(). If an application developer overrides these methods and dynamically constructs the return value using untrusted, user-influenced data—or if the associated resource bundles are populated with unsanitized external input—the resulting string is written directly into the markup without escaping.\nThe attack flow initiates when an attacker triggers the rendering of a form containing an affected DropDownChoice component. If the attacker can influence the data source or bundle entry used for the null choice, they can inject malicious payloads, such as '<script>alert(document.cookie)</script>'.\nUpon rendering, the Wicket framework generates the HTML select markup. Because the framework does not sanitize the return value of the null-display methods, the browser receives the raw, malicious payload within the null option tag. When the victim views the page, the browser interprets the injected JavaScript, leading to the execution of malicious code in the context of the application's origin.\nThis vulnerability is particularly dangerous because it bypasses the security controls applied to standard list items, creating a 'blind spot' in the component's output encoding logic. The requirement for exploitation is that the application must rely on a vulnerable override or an improperly secured resource bundle. No authentication or elevated privileges are required if the injection point is reachable by the attacker through standard application interactions.\nThe component affected is primarily AbstractSingleSelectChoice and its subclasses, such as DropDownChoice. Notably, RadioChoice is immune to this specific vector as it explicitly emits no default null option. The vulnerability persists across a wide range of Apache Wicket versions: 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0, as well as legacy branches 1.5.0 through 7.x."
}