CVE-2026-111089 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Wicket applications should assess exposure and prioritize upgrading to patched versions to prevent XSS attacks. They should review and update affected applications to ensure proper escaping of localized labels and CSS class names. Defenders should also implement Content Security Policy (CSP) to prevent inline event handlers and verify affected versions and remediation.

Why it matters

Apache Wicket is vulnerable to XSS due to improper escaping of localized labels and CSS class names. Defenders should prioritize upgrading to patched versions to prevent XSS attacks.

• XSS attacks can be launched by injecting malicious scripts into the application's origin
• Defenders need to verify affected versions and upgrade to patched versions
• Proper escaping of localized labels and CSS class names is necessary to prevent XSS

Technical summary

Apache Wicket reads texts from the application's resource bundles and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, allowing for XSS attacks. The vulnerability affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Users should upgrade to version 8.20.0, 9.25.0, or 10.12.0 to fix the issue.

Defensive priority

Defenders should prioritize upgrading to patched versions of Apache Wicket to prevent XSS attacks.

Recommended defensive actions

• Upgrade to Apache Wicket version 8.20.0, 9.25.0, or 10.12.0
• Review and update affected applications to ensure proper escaping of localized labels and CSS class names
• Implement Content Security Policy (CSP) to prevent inline event handlers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, but further verification is needed to confirm affected versions and remediation. Apache Wicket's resource bundle entries are read and written into JavaScript and markup without proper escaping, allowing for XSS attacks. The Content-Security-Policy sent by Apache Wicket 9.x and 10.x does not prevent the JavaScript cases. Users of Apache Wicket 7.x or older should upgrade to a supported version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.