CVE-2026-42224 ipl/web is vulnerable to reflected XSS by malformed search requests
Attackers can inject malicious JavaScript into Icinga Web via malformed search requests, allowing code execution in the victim's browser context.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42224?
CVE-2026-42224 is a high-severity cross-site scripting vulnerability in Icinga ipl-web, published on 8 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
Weakness: CWE-79
Which versions are affected by CVE-2026-42224?
4 open source packages ship an affected version, including ipl/web.
| Package | Affected | Fixed in |
|---|---|---|
ipl/web Packagist | All versions | 0.10.3 |
ipl/web Packagist | All versions | 0.10.3 |
ipl/web Packagist | From 0.11.0 | 0.13.1 |
ipl/web Packagist | From 0.11.0 | 0.13.1 |
Linux distribution packages (1)
icinga-php-library openSUSE:Tumbleweed | All versions | 0.19.2-1.1 |
How do I fix CVE-2026-42224?
Upgrade ipl/web to a fixed version for your release line: 0.10.3 or 0.13.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42224 being exploited?
There is no known exploitation of CVE-2026-42224 in the wild and no public exploit code.
Sources
Also known as GHSA-55wf-5m3q-6jjf, openSUSE-SU-2026:10693-1.