{"id":"CVE-2026-42509","aliases":["EUVD-2026-27556","GHSA-5x9h-93gp-chpj"],"status":"published","title":"Apache Wicket: crafted strings can break out of the JavaScript sequence","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00357,"percentile":0.29844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-06T08:34:00Z","modified":"2026-11-10T02:32:11Z","fixes":[{"ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","fixed_in":["10.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-M1"},{"last_affected":"8.17.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.22.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.8.0"},{"fixed":"10.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-M1"},{"last_affected":"8.17.0"}]}],"versions":["8.0.0","8.0.0-M1","8.0.0-M2","8.0.0-M3","8.0.0-M4","8.0.0-M5","8.0.0-M6","8.0.0-M7","8.0.0-M8","8.0.0-M9","8.1.0","8.10.0","8.11.0","8.12.0","8.13.0","8.14.0","8.15.0","8.16.0","8.17.0","8.2.0","8.3.0","8.4.0","8.5.0","8.6.0","8.6.1","8.7.0","8.8.0","8.9.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.22.0"}]}],"versions":["9.0.0","9.0.0-M1","9.0.0-M2","9.0.0-M3","9.0.0-M4","9.0.0-M5","9.1.0","9.10.0","9.11.0","9.12.0","9.13.0","9.14.0","9.15.0","9.16.0","9.17.0","9.18.0","9.19.0","9.2.0","9.20.0","9.21.0","9.22.0","9.3.0","9.4.0","9.5.0","9.6.0","9.7.0","9.8.0","9.9.0","9.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wicket:wicket-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.9.0"}]}],"versions":["10.0.0","10.0.0-M1","10.0.0-M2","10.1.0","10.2.0","10.3.0","10.4.0","10.5.0","10.6.0","10.7.0","10.8.0"]}],"products":[{"vendor":"apache","product":"wicket"},{"vendor":"apache software foundation","product":"apache wicket"}],"references":[{"url":"https://lists.apache.org/thread/52nrq4tt07gxz4r6sj5gyocz5s6bprjp","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/06/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42509","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5x9h-93gp-chpj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42509.json","tags":["advisory"]},{"url":"https://github.com/apache/wicket","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42509","title":"Apache Wicket: crafted strings can break out of the JavaScript sequence","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:00.746Z","modified":"2026-05-07T12:16:58.182Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-27556","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:00Z","modified":"2026-05-07T12:16:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-5x9h-93gp-chpj","title":"Apache Wicket has a Cross-site Scripting issue","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T12:30:25Z","modified":"2026-05-11T14:22:00Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-42509","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T10:16:20.217Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"CVE-2026-42509","title":"Apache Wicket: crafted strings can break out of the JavaScript sequence","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T08:34:00.746Z","modified":"2026-11-10T02:32:11.615869079Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-10T02:45:42.584685Z"},{"id":"GHSA-5x9h-93gp-chpj","title":"Apache Wicket has a Cross-site Scripting issue","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.\n\nUsers are recommended to upgrade to version 10.9.0, which fixes the issue.","status":"published","published":"2026-05-06T12:30:25Z","modified":"2026-05-11T14:41:25.950629Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}