### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. ### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. ### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. ### References None
Update ipl/web to 0.13.1; ipl/web to 0.10.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanipl/web is vulnerable to reflected XSS by malformed search requests affects ipl/web (composer), ipl/web (composer). Severity is high. ### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. ### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. ### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. ### References None
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ipl/webcomposer |
### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. ### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. ### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. ### References None
Update ipl/web to 0.13.1; ipl/web to 0.10.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanipl/web is vulnerable to reflected XSS by malformed search requests affects ipl/web (composer), ipl/web (composer). Severity is high. ### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. ### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2. ### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0. ### References None
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ipl/webcomposer |
| >=0.11.0,<=0.13.0 |
| 0.13.1 |
| ipl/webcomposer | <=0.10.2 | 0.10.3 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| >=0.11.0,<=0.13.0 |
| 0.13.1 |
| ipl/webcomposer | <=0.10.2 | 0.10.3 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard