CVE-2026-111089

{
  "etk_id": "ETK-2026-3248",
  "cve_id": "CVE-2026-111089",
  "display_id": "CVE-2026-111089",
  "ghsa_id": "GHSA-8xp3-3x4j-prp2",
  "euvd_id": "EUVD-2026-114904",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Resource-bundle cross-site scripting in Apache Wicket",
  "summary": "Apache Wicket wicket-core versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 can render resource-bundle values into JavaScript or HTML attribute contexts without appropriate escaping. An attacker who can influence one of these bundle values may execute script in the application's origin when an affected component renders it.",
  "mitigation": "Upgrade to Apache Wicket 8.20.0, 9.25.0, or 10.12.0 for the applicable major version. Until upgraded, limit modification of resource bundles to trusted maintainers and review bundle values used by rendered components.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Wicket",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.0.0, <= 8.19.0",
        ">= 9.0.0, <= 9.24.0",
        ">= 10.0.0, <= 10.11.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "org.apache.wicket:wicket-core",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.166794366666668,
  "t0_at": "2026-11-01T22:32:09.104000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-01T22:32:09.104000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-01T22:32:09.104000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111089"
    }
  }
}