ip-address: XSS in Address6 HTML-emitting methods
Priority MEDIUM 57CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 27 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00471 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ip-address (beaugunderson): 10.1.1ip-address (npm): 10.1.1Red Hat: 31 advisoriesRed Hat: 27 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| beaugunderson | ip-address | before 10.1.1 | 10.1.1 | Patch available | CNA |
| — | ip-address (npm) | before 10.1.1 | 10.1.1 | Patch available | GHSA-v2v4-37r5-5v8g |
- ip-address Vendorbeaugunderson Affected before 10.1.1 Fixed in 10.1.1 Patch available CNA
- ip-address (npm) Vendor— Affected before 10.1.1 Fixed in 10.1.1 Patch available GHSA-v2v4-37r5-5v8g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:beaugunderson:ip-address:*:*:*:*:*:node.js:*:* | before 10.1.1 | Vulnerable | beaugunderson |
- cpe:2.3:a:beaugunderson:ip-address:*:*:*:*:*:node.js:*:* Versions before 10.1.1 Vulnerable ·beaugunderson
Remediation
- Fix · CNA ip-address (beaugunderson) Fixed in 10.1.1
- Fix · GHSA-v2v4-37r5-5v8g ip-address (npm) Fixed in 10.1.1 Advisory →
Red Hat 31 advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
Show 28 more Red Hat advisories
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:62336 Released 2026-09-01 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.6 enhancement update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:62335 Released 2026-09-01 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.6 enhancement update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:52399 Released 2026-08-10 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22 +28
- RHSA-2026:51200 Released 2026-08-06 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:44267 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.21.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:44263 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.20.31 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
- RHSA-2026:44237 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.22.7 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:41947 Released 2026-07-20 · Red Hat rating Importantnodejs:22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el8.10.0+24500+8eb51621.s390x::nodejs:22 +28
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:39868 Released 2026-07-15 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el8.10.0+24481+7a71fac8.s390x::nodejs:24 +25
- RHSA-2026:39246 Released 2026-07-14 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.1-2.el10_0, nodejs-devel-1:22.23.1-2.el10_0, nodejs-docs-1:22.23.1-2.el10_0 +4
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:35892 Released 2026-07-06 · Red Hat rating Importantnodejs:22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.aarch64::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.ppc64le::nodejs:22, nodejs-1:22.23.1-1.module+el9.8.0+24457+996af7aa.s390x::nodejs:22 +28
- RHSA-2026:35891 Released 2026-07-06 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.aarch64::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.ppc64le::nodejs:24, nodejs-1:24.18.0-1.module+el9.8.0+24456+b244c3b4.s390x::nodejs:24 +25
- RHSA-2026:35842 Released 2026-07-06 · Red Hat rating Importantnodejs22 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-2.el10_2, nodejs-devel-1:22.23.1-2.el10_2, nodejs-docs-1:22.23.1-2.el10_2 +4
- RHSA-2026:35841 Released 2026-07-06 · Red Hat rating Importantnodejs24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-1.el10_2, nodejs24-devel-1:24.18.0-1.el10_2, nodejs24-docs-1:24.18.0-1.el10_2 +3
- RHSA-2026:34374 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
- RHSA-2026:33574 Released 2026-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.9.6 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:33183 Released 2026-06-29 · Red Hat rating ImportantKiali 2.22.6 for Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33173 Released 2026-06-29 · Red Hat rating ImportantKiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33163 Released 2026-06-29 · Red Hat rating ImportantKiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33160 Released 2026-06-29 · Red Hat rating ImportantKiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33155 Released 2026-06-29 · Red Hat rating ImportantKiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Exploit Intelligence | Affected | No fix yet |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:34374 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:33574 |
| Red Hat Enterprise Linux AI 3.3 | Fixed | RHSA-2026:62335, RHSA-2026:62336 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:35841, RHSA-2026:35842 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:39868, RHSA-2026:41947 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:35891, RHSA-2026:35892 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:39246 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:52399 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:44263 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:44267 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:44237 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:33155 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:33160 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:33163 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:33173 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:33183 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:51200 |
Not affected: 22 products
- Cryostat 4
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Service Mesh 3.3
- Red Hat Openshift Data Foundation 4.22
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42338
- 2026-10-03 Alias added: GHSA-v2v4-37r5-5v8g
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Sources
- CVE-2026-42338 · CVE Program
- CVE-2026-42338 · NVD
- FIRST EPSS
- GHSA-v2v4-37r5-5v8g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42338 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences