XSS via ip-address JS lib <10.1.1: Address6.group & link not escaped
CVE-2026-42338 Published on May 12, 2026

ip-address: XSS in Address6 HTML-emitting methods
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-42338 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-42338. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-42338 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2026-42338

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Service Mesh

Red Hat Confidential Compute Attestation

Red Hat Cryostat

Red Hat Exploit Intelligence

Red Hat Rhmt

Red Hat Multicluster Engine

Red Hat Openshift Pipelines

Red Hat Amq Broker

Red Hat Ansible Automation Platform

Red Hat Apache Camel Hawtio

Red Hat Podman Desktop

Red Hat Rhdh

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Ai

Red Hat Hummingbird

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Devspaces

Red Hat Satellite

Red Hat Ansible Portal

Red Hat Acm

Red Hat Camel Spring Boot

Red Hat Enterprise Linux Eus

Affected Versions

beaugunderson ip-address:

Version < 10.1.1 is affected.

Red Hat Enterprise Linux 10:

Version 1:24.18.0-1.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 1:22.23.1-2.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 1:22.23.1-2.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020260630152626.6d880403 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020260703140402.6d880403 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 9080020260626074955.rhel9 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 9080020260626075442.rhel9 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1782721130 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1783448184 and below * is unaffected.

Red Hat Developer Hub 1.9:

Version 1782761244 and below * is unaffected.

Red Hat Migration Toolkit 1.8:

Version 1783690532 and below * is unaffected.

Red Hat OpenShift Container Platform 4.2:

Version 1784724699 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1784713741 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1784721581 and below * is unaffected.

Red Hat OpenShift Dev Spaces 3.29:

Version 1782498475 and below * is unaffected.

Red Hat OpenShift Dev Spaces 3.29:

Version 1782498792 and below * is unaffected.

Red Hat OpenShift Service Mesh 2.6:

Version 1781937133 and below * is unaffected.

Red Hat OpenShift Service Mesh 2.6:

Version 1782287580 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.0:

Version 1782201894 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.0:

Version 1782201833 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.1:

Version 1782201696 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.1:

Version 1782201537 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.2:

Version 1782201851 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.2:

Version 1782201812 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.3:

Version 1782231869 and below * is unaffected.

Red Hat OpenShift Service Mesh 3.3:

Version 1782201466 and below * is unaffected.

Red Hat Satellite 6.19:

Version 1786008041 and below * is unaffected.

Red Hat Confidential Compute Attestation: Red Hat Cryostat 4: Red Hat Cryostat 4: Red Hat Exploit Intelligence: Red Hat Multicluster Engine for Kubernetes: Red Hat OpenShift Pipelines: Red Hat OpenShift Pipelines: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat AMQ Broker 7: Red Hat build of Apache Camel for Spring Boot 4: Red Hat build of Apache Camel - HawtIO 4: Red Hat Build of Podman Desktop: Red Hat Build of Podman Desktop - Tech Preview: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat Hardened Images: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Dev Spaces: Red Hat Self-service automation portal 2:

Exploit Probability

EPSS

0.47%

Percentile

38.11%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.