High severity7.6GHSA Advisory· Published May 8, 2026· Updated Jun 9, 2026
CVE-2026-42224
CVE-2026-42224
Description
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ipl/webPackagist | >= 0.11.0, < 0.13.1 | 0.13.1 |
ipl/webPackagist | < 0.10.3 | 0.10.3 |
Affected products
3- ghsa-coords2 versions
< 0.13.1+ 1 more
- (no CPE)range: < 0.13.1
- (no CPE)range: < 0.19.2-1.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-55wf-5m3q-6jjfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42224ghsaADVISORY
- github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065dnvdWEB
- github.com/Icinga/ipl-web/releases/tag/v0.10.3nvdWEB
- github.com/Icinga/ipl-web/releases/tag/v0.13.1nvdWEB
- github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjfnvdWEB
News mentions
0No linked articles in our index yet.