CVE-2026-84231

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element. This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, which fixes the issue.

• CWE-79

• https://lists.apache.org/thread.html/39kz9838w25797bpkxn1hvfsm8jtc4zv

Published

Nov 1, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84223The Kirki WordPress plugin before 6.3.1 does not sanitize u…6.8
• CVE-2026-84224The Kirki WordPress plugin before 6.3.2 does not validate th…4.1
• CVE-2026-84225The Kirki WordPress plugin before 6.3.0 does not check that…2.2
• CVE-2026-84226OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through …8.5
• CVE-2026-8423The JaviBola Custom Theme Test plugin for WordPress is vulne…4.3
• CVE-2026-84230IBM Guardium Data Protection 12.2.2 could allow a remote att…5.9
• CVE-2026-84232A flaw was found in pulpcore's content serving application. …5.4
• CVE-2026-84233A flaw was found in rpm. A local attacker could supply a spe…7
• CVE-2026-84235A denial-of-service security issue exists in the affected pr…8.7
• CVE-2026-84238Unauthenticated Broken Access Control in YITH Request a Quot…9.8
• CVE-2026-84239IBM Guardium Data Protection 12.2 could allow a remote authe…7.6
• CVE-2026-8424The Remove Yellow BGBOX plugin for WordPress is vulnerable t…4.3