CVE-2026-76983

Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no escaping setting at all, so markup in a label is rendered as markup. When the label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. There is no workaround. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped. The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

• CWE-79

• https://lists.apache.org/thread/lfc9s9qkgxhm8ffscp9b7gjfgj47g25hVendor Advisory, Mailing List
• https://www.openwall.com/lists/oss-security/2026/08/31/3Mailing List, Third Party Advisory

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76977SAP UI5 does not sufficiently validate the parent frame's or…4.3
• CVE-2026-76978ZohoCorp ManageEngine OpManager and Firewall Analyzer versio…8.8
• CVE-2026-76979ZohoCorp ManageEngine OpManager and Firewall Analyzer versio…7.7
• CVE-2026-7698A vulnerability was identified in Tiandy Easy7 Integrated Ma…7.3
• CVE-2026-76980ZohoCorp ManageEngine OpManager and Firewall Analyzer versio…7.4
• CVE-2026-76982Improper neutralization of input during web page generation …5.4
• CVE-2026-76984Improper neutralization of input during web page generation …5.4
• CVE-2026-76985Improper neutralization of input during web page generation …5.4
• CVE-2026-76986Improper neutralization of input during web page generation …6.1
• CVE-2026-76987A security flaw has been discovered in liftoff-sr CIPster 18…7.3
• CVE-2026-76988A weakness has been identified in liftoff-sr CIPster 1802525…5.3
• CVE-2026-76989A security vulnerability has been detected in liftoff-sr CIP…5.3