THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-42338 (MEDIUM 6.1) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emi

[NVD] CVE-2026-42338 (MEDIUM 6.1) — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emi

lownvdPublished 2026-05-12

CVE-2026-42338 CVSS: 6.1 MEDIUM Published: 2026-05-12T20:16:41.130

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input)

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-42338cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42338