Apache Wicket CVE-2026-83559

Exploitation requires that an application call org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() and place its output inside a JavaScript string literal, and that the escaped value hold attacker-influenced data containing a backslash immediately before a quote; no Wicket component need be involved. For the bundled AjaxEditableLabel component specifically, the application must have authored a custom validation feedback message that interpolates the submitted 'input' variable (or another attacker-controlled variable) - none of Wicket's shipped message bundles interpolate it, so stock configurations are not affected through this component. AjaxListPanel is not exploitable because tag serialization writes quotes as character references. Limiting factors: active user interaction is required (the victim must view the page rendering the response, UI:A), no authentication is needed to submit the input (PR:N), the bug is present only in versions 8.0.0-8.19.0, 9.0.0-9.24.0 and 10.0.0-10.11.0, and the application must use the method unsafely for the flaw to be reachable at all.

This is a genuine but conditional output-encoding/XSS flaw (CWE-116) rather than a drop-everything emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) scores 7.4: network-reachable, no authentication, but it carries an explicit Attack Requirement (AT:P) and requires active user interaction (UI:A) - the victim must load the page rendering the broken literal. The AT:P flag is the key signal: exploitation depends on the application (or a bundled component) actually calling JavaScriptUtils#escapeQuotes() and placing its result inside a JavaScript string literal with an attacker-influenced value, and Apache states the shipped components are safe by default (AjaxListPanel is not affected at all; AjaxEditableLabel is affected only where the application has written a custom validation message that interpolates the submitted input). Signals are only partially available and must be read with care: there is no CISA KEV listing and no EPSS probability was provided, so widespread-exploitation likelihood cannot be quantified from the input; the only reference is the Apache advisory and no public PoC is referenced. The vuln.today decision label is 'this_week', consistent with a real, patch-this-cycle issue whose practical reach is gated by whether a given application uses the method unsafely rather than by Wicket's defaults. Net: prioritize for the current patch cycle, especially where custom validation messages echo user input, but this is not a universally exploitable default-configuration bug.

An attacker submits form input containing a backslash immediately before a quote into a field whose failed-validation feedback message is written into a single-quoted JavaScript string literal in an Ajax response (e.g. via AjaxEditableLabel where the application customized the message to include the submitted value). Because escapeQuotes() leaves the backslash unescaped, the doubled backslash escapes the escaping backslash, the quote closes the literal, and the remainder of the input is parsed as JavaScript that runs in the victim's session and the application's origin when they view the page. No public exploit is referenced, so this is a described mechanism, not a confirmed weaponized exploit.