Cross-Site Scripting Vulnerability in Icinga Web Components

CVE-2026-42224

What is CVE-2026-42224?

A vulnerability exists in the Icinga Web components prior to version 0.13.1, allowing attackers to inject malicious JavaScript into a victim's browser. This injection happens when the victim visits a specifically crafted website, where the malicious script is executed in the context of Icinga Web, potentially compromising user data and session security. This issue has been addressed in the 0.13.1 update, emphasizing the importance of keeping software up to date to mitigate such risks.

References