CVE-2026-84231 Apache Software Foundation CVE debrief

Who should care

Developers and administrators using Apache Wicket, particularly those who have applications that use the ExternalLink component, should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 8.20.0 and reviewing affected applications for potential exposure.

Why it matters

CVE-2026-84231 allows for JavaScript injection in Apache Wicket applications, requiring upgrade to version 8.20.0 and review of affected applications.

• Potential JavaScript injection attacks
• Upgrade priority for Apache Wicket users
• Review of affected applications required

Technical summary

The Apache Wicket ExternalLink component does not properly escape URLs, allowing for JavaScript injection when bound to non-anchor tags. This issue affects Apache Wicket from 8.0.0 through 8.19.0. Users are recommended to upgrade to version 8.20.0, which fixes the issue. The vulnerability requires user interaction to exploit, as it involves clicking on a specially crafted link. The impact of a successful exploit could allow an attacker to execute arbitrary JavaScript code in the context of the affected application.

Defensive priority

Upgrade to version 8.20.0

Recommended defensive actions

• Upgrade to Apache Wicket version 8.20.0
• Review and update affected applications
• Monitor for potential JavaScript injection attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The ExternalLink component in Apache Wicket does not properly escape URLs, allowing for JavaScript injection when bound to non-anchor tags. This issue is exacerbated by the fact that the URL held in the component's model is concatenated into a single-quoted JavaScript string literal without being escaped for that context. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. The issue affects Apache W.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.