High [CVE-2026-83539] Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket.

org.apache.wicket.extensions.markup.html.basic. SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink.

DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path.

A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated.

Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string. Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe.

An application is affected where it renders text it received through either of these two components.