Apache Wicket SmartLinkLabel Cross-Site Scripting (XSS) Vulnerability (CVE-2026-83539)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 utilizing SmartLinkLabel or SmartLinkMultiLineLabel components
Attackers can inject malicious URL schemes (e.g., javascript:) that bypass standard markup escaping, leading to arbitrary script execution in the victim's browser session upon clicking the link
Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or higher, and ensure a robust Content-Security-Policy (CSP) is enforced
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update your project's build configuration to pull the patched versions of Apache Wicket (8.20.0+, 9.25.0+, or 10.12.0+).
Maven (pom.xml):
<!-- Update the wicket.version property to a secure release -->
<properties>
<!-- Use 8.20.0 for 8.x, 9.25.0 for 9.x, or 10.12.0 for 10.x -->
<wicket.version>10.12.0</wicket.version>
</properties>
<dependencies>
<dependency>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-extensions</artifactId>
<version>${wicket.version}</version>
</dependency>
</dependencies>Gradle (build.gradle):
ext {
wicketVersion = '10.12.0'
}
dependencies {
implementation "org.apache.wicket:wicket-extensions:${wicketVersion}"
}2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, restrict script execution by enforcing a strict Content-Security-Policy (CSP) header that does not allow unsafe-inline scripts or arbitrary URL schemes.
Nginx Reverse Proxy CSP Configuration:
# Add CSP header to block execution of injected javascript: schemes
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-randomNonceValue'; object-src 'none';" always;3. Log Audit & IoC Verification Commands
Scan your codebase to identify usages of the vulnerable components and verify the resolved dependency tree.
Shell Script to Scan Codebase and Dependencies:
#!/bin/bash
echo '[*] Scanning codebase for vulnerable Wicket components...'
grep -rnw './' --include='*.java' -e 'SmartLinkLabel' -e 'SmartLinkMultiLineLabel'
echo '[*] Verifying resolved Maven dependencies...'
mvn dependency:tree | grep 'wicket-extensions'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-83539) exists in Apache Wicket's SmartLinkLabel and SmartLinkMultiLineLabel components, which are designed to automatically convert URLs and email addresses in text into clickable HTML anchor tags. While these components escape the model value using standard markup escaping (Strings#escapeMarkup()), this escaping is insufficient for URL contexts. The escaped text is passed to DefaultLinkParser, which parses any string matching the scheme://rest pattern and wraps it in an href attribute without validating or restricting the allowed URI schemes.
2. Exploitation Mechanics & Attack Scenario
An attacker can submit input containing a malicious URI scheme, such as javascript:alert(1) or data: payloads. Because DefaultLinkParser lacks a whitelist of permitted schemes, it accepts the input and generates an anchor tag like <a href='javascript:...'>. Although rendering the page alone does not trigger the payload, the script executes immediately within the application's origin and the reader's active session once the victim clicks the generated link.
3. Infrastructure & Business Impact
Successful exploitation can lead to session hijacking, credential theft, unauthorized actions via CSRF, and defacement of the web application. Wicket 8.x is highly vulnerable as it lacks native CSP support. While Wicket 9.x and 10.x mitigate this by default using nonce-based CSP, any application that has disabled or weakened its CSP remains fully vulnerable to this high-severity exploit.
Official Vendor Advisories & References
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe. An application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected. On 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Frequently Asked SecOps Questions (CVE-2026-83539)
FAQQ1. How critical is CVE-2026-83539 and is it actively exploited in the wild?
CVE-2026-83539 is rated CVSS 7.4 (HIGH) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-83539?
Primary impacted vendors include apache across wicket. Scope summary: Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0
Q3. What temporary mitigations or workarounds exist for CVE-2026-83539 before patching?
[Mitigation] Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or higher, and ensure a robust Content-Security-Policy (CSP) is enforced Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-83539
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache Wicket AjaxNewWindowNotifyingBehavior Cross-Site Scripting (XSS) Vulnerability (CVE-2026-82956)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, specifically when AjaxNewWindowNotifyingBehavior is explicitly used
Apache Wicket JavaScriptUtils Escape Bypass Remote Script Execution Vulnerability (CVE-2026-83559)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x or older versions
Apache Wicket Cross-Site Scripting (XSS) Vulnerability due to Missing Resource Bundle Escaping (CVE-2026-111089)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0
Apache Wicket WebSocket Resource Missing Authorization Vulnerability (CVE-2026-82115) Analysis & Mitigation Guide
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x releases
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.