CVE-2026-42338 ip-address: XSS in Address6 HTML-emitting methods

🗓️ 12 May 2026 19:43:16Reported by GitHub_MType

XSS in Address6 HTML methods of ip-address before 10.1.1 due to unescaped content in group, link, and parseMessage.

Reporter	Title	Published	Views	Family All 158
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)	23 Jul 202608:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses ip-address-10.1.0.tgz and fast-xml-builder-1.1.5.tgz which are vulnerable to CVE-2026-44664, CVE-2026-44665 and CVE-2026-42338.	30 Jun 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses ip-address-10.1.0.tgz which is vulnerable to CVE-2026-42338	29 Jun 202615:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in ip-address-9.0.5.tgz	9 Jun 202615:26	–	ibm
ATTACKERKB	CVE-2026-42338	12 May 202619:43	–	attackerkb
Tenable Nessus	AlmaLinux 10 : nodejs24 (ALSA-2026:35841)	6 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : nodejs22 (ALSA-2026:35842)	6 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:24 (ALSA-2026:35891)	7 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:22 (ALSA-2026:35892)	7 Jul 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : nodejs:24 (ALSA-2026:39868)	16 Jul 202600:00	–	nessus

[
  {
    "vendor": "beaugunderson",
    "product": "ip-address",
    "versions": [
      {
        "version": "< 10.1.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g

12 May 2026 19:43Current

CVSS 45.3

EPSS0.00471

CWE-79