CVE-2026-42338 ip-address: XSS in Address6 HTML-emitting methods
Attackers can execute arbitrary scripts in victim browsers if applications render unescaped IPv6 address data from this library as HTML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42338?
CVE-2026-42338 is a medium-severity cross-site scripting vulnerability in beaugunderson ip-address, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-42338?
2 open source packages ship an affected version, including ip-address. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ip-address npm | All versions | 10.1.1 |
ip-address npm | All versions | 10.1.1 |
Products include Beaugunderson Ip-Address.
How do I fix CVE-2026-42338?
Upgrade ip-address to 10.1.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42338 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42338 exists.
Sources
Also known as CLEANSTART-2026-JW65236, CLEANSTART-2026-UV41499, CLEANSTART-2026-WK56892, CLEANSTART-2026-WX98104, CLSA-2026-1782694761, CLSA-2026-1790006158 and 43 more.