High severity7.6GHSA Advisory· Published May 8, 2026· Updated May 13, 2026
CVE-2026-42224
CVE-2026-42224
Description
ipl/web is a set of common web components for php projects. Prior to version 0.13.1, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in version 0.13.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ipl/webPackagist | < 0.13.1 | 0.13.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-55wf-5m3q-6jjfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42224ghsaADVISORY
- github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065dnvdWEB
- github.com/Icinga/ipl-web/releases/tag/v0.13.1nvdWEB
- github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjfnvdWEB
News mentions
0No linked articles in our index yet.