CVE-2026-42338

Aliases:GHSA-v2v4-37r5-5v8gDEBIAN-CVE-2026-42338CGA-247q-hwp3-mqq6CGA-2rwr-35mr-jf3cCGA-3mx9-hv8h-hjv4CGA-3vf2-cmpp-6cwrCGA-4772-53q2-cj93CGA-488f-p5rj-2cf4CGA-4p6w-gr9f-ff3pCGA-4r63-2cvm-f8vmCGA-4w5h-r7v9-m42pCGA-5fph-4qrp-gj3cCGA-5grc-99f7-v3j8CGA-5r3r-5v2w-wr94CGA-5x2m-g2cg-44mpCGA-5xf3-q8xx-3336CGA-666j-27g7-g3c9CGA-6994-rm35-h832CGA-6x36-v47p-7wc2CGA-7crp-559r-jfj2CGA-7j2p-5hw4-38v7CGA-7xmp-pqf9-xmx7CGA-8p5m-r3x3-x7qgCGA-8pc7-cgg6-3x74CGA-92w3-jwqw-pj3mCGA-98vf-xrmh-39v8CGA-9v54-5grg-7rrxCGA-fcr2-cw4h-rg47CGA-g859-367g-j7w5CGA-gjw8-pq5j-7c9pCGA-h93m-ghm4-mq4pCGA-j45g-v89v-vm74CGA-jjxr-gph6-f7r5CGA-mr88-45r2-q2f3CGA-mvg3-4g4v-98cpCGA-pc57-jqj3-g5cmCGA-pj6h-6ppw-hjm8CGA-pmpc-rfmr-wxj7CGA-pxv2-7vxj-f9chCGA-2575-49r7-6935CGA-25m4-4449-38cfCGA-2655-5hm7-9w49CGA-2699-v6r3-gw64CGA-29j8-9m3x-mq43CGA-2fc2-4h9q-hv6xCGA-2g8p-q4h4-c6wvCGA-2p3f-f2gw-jv6qCGA-326q-h8cc-6ww5CGA-39rr-qm33-9mvxCGA-3cv2-w864-ppqwCGA-3g84-hfwv-5fpcCGA-3x4x-5g2w-v3c8CGA-4chg-xxp6-jrxfCGA-4fg7-rqh8-v22qCGA-4p6w-px88-xj28CGA-56vx-vqm2-2j76CGA-5cgc-wrvj-xxf5CGA-5jcp-rmj3-cjcvCGA-63jp-cwjm-cm4fCGA-6f9v-2jqc-c98gCGA-6gfg-gg5h-5mxmCGA-6j4v-m3r8-f5mqCGA-6jr9-rv95-w8mjCGA-6qxg-8vp9-x724CGA-7493-5892-j3g6CGA-7643-3fqr-hhcjCGA-76gj-j8cm-h5g7CGA-7gpw-625j-3h63CGA-7gxf-2hjj-p64vCGA-7mgq-jv3w-mhcjCGA-7vqx-pqc9-593wCGA-822m-pv86-rhvmCGA-82x4-w4hg-wg46CGA-8527-x456-vwp4CGA-858r-fm93-8334CGA-8g33-vhj9-8wjwCGA-8h9w-7c3w-cgfcCGA-8vg5-h7c3-9269CGA-8wqw-55c6-w42cCGA-96xf-jg4w-w5m2CGA-978j-r997-c6mjCGA-9f94-r863-3x6qCGA-9pgj-w6r8-f7w4CGA-9vfg-hh6w-qxjpCGA-c6r8-25r2-m4w6CGA-c73c-x3jw-xqpvCGA-cj6q-728h-69frCGA-cqfm-gh7f-9g99CGA-cvr5-7r4h-6fw4CGA-cvw9-v832-rcqpCGA-cwjh-pxcw-85fxCGA-f2c5-3xv4-cqxmCGA-f4qr-28xg-hpjvCGA-f5xq-6w86-m82mCGA-f97p-v56f-rq3rCGA-ff4p-q6m6-h872CGA-ff83-q54c-wgg8CGA-ff86-3fjp-7p2xCGA-g4c3-7hx2-3754CGA-g7f4-r4c8-65w3CGA-ggxw-h38q-w8rqCGA-gh86-87cm-4r3qCGA-gr37-fw4w-vjmcCGA-hch9-mpw3-8jh4CGA-hg32-wwm6-gqvfCGA-hr2x-f5gh-49chCGA-hr82-fp2h-8f23CGA-j6v7-27mr-jr94CGA-j74w-7mqg-q4cmCGA-j8cv-cjrm-xp5wCGA-j8vw-w6rp-wg78CGA-jh5p-7mpf-9989CGA-jhwq-hc6v-66p8CGA-jj4x-2mq6-gwxhCGA-jq7c-6j7f-4rj8CGA-jxx8-6ggf-hf47CGA-m4jf-vv7h-g4m4CGA-mcqx-pr6m-2h45CGA-mq36-rhm2-rj68CGA-mq79-7gwp-v9mmCGA-p27w-w3gw-66wpCGA-p3x7-ffr6-jv5fCGA-ph2r-xxww-jm7fCGA-pm5c-cjwm-98w5CGA-ppxx-8fp4-qmwqCGA-pqcf-v8mr-g87hCGA-pw2g-6qq8-9p5cCGA-q46c-mx23-98r6CGA-q69r-v9j8-846hCGA-q72p-g556-29jgCGA-q7h5-25qc-r6vwCGA-q7h8-hpx5-9ch8CGA-qhv9-75fm-c6gqCGA-qq76-32xw-hwp6CGA-r86m-f85c-vq4hCGA-rcv4-c373-9qx6CGA-rgp4-7mfw-gcw6CGA-v3c4-h6hw-8cw5CGA-v5m7-v45g-79hgCGA-v6ff-h7fj-4mfpCGA-v6p6-8r84-48cgCGA-v7x2-85qr-4vpgCGA-v977-m622-qx55CGA-vfmc-w49q-r8f8CGA-vm35-f325-84ggCGA-vm66-hpwm-p933CGA-vp65-chvq-gm9hCGA-vpjr-g75m-6jxfCGA-vwhp-c9gg-9vc7CGA-w28r-rw3c-x8frCGA-w384-wrfr-47ppCGA-w9p3-h25c-ww96CGA-w9q8-wx38-gvc9CGA-w9xh-q4gc-3vf2CGA-wghx-xx85-xx4fCGA-wj67-p42h-x9jqCGA-wmrx-f34c-7jqcCGA-wp27-pc9p-5x95CGA-x2jq-mm8r-73wpCGA-x2wg-vxrp-hr74CGA-x33x-cc92-g56hCGA-x463-j5pv-g23vCGA-x4r3-jggf-8pxrCGA-x7cc-86mj-m995CGA-xgqp-mmh6-76mpCGA-xpmm-c785-5xr3CGA-xv4w-2c23-9j5rCGA-37qr-g39g-f78xCGA-4jxx-2ch8-h6c5CGA-cf9v-8hqv-269mCGA-5prq-8gr5-fcpwCGA-6mwj-p2vf-qq95CGA-qrj9-9jgg-35pmCGA-2738-vwg4-xpxjCGA-3pcm-v22g-xx3rCGA-r2fx-5cw6-xr23CGA-wmfp-3w72-gmvpCGA-j88h-vv3c-64pjCGA-w33c-fppr-78rm
Advisory lineage Upstream: 0 Downstream: 21
Modified
Published: 12 May 2026, 19:43
Last modified:11 Sept 2026, 12:08

Vulnerability Summary

Overall Risk (default)
medium
42/100
CVSS Score
8.1 HIGH
v3.1 (cve.org)
EPSS Score
0.47% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 May 2026, 19:43
Published
Vulnerability first disclosed
11 Sept 2026, 12:08
Last Modified
Vulnerability information updated

Description

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.47%• Percentile: 40%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • chainguard•actions-runner

    < 2.334.0-r1

  • chainguard•code-server

    < 4.112.0-r4

  • chainguard•commercial-gitlab-rails-ee-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-19.3

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.3

    all

  • chainguard•drupal-11.3

    < 11.3.13-r3

  • chainguard•gemini-cli

    < 0.41.2-r0

  • chainguard•graalvm-25-ce-nodejs

    < 25.0.4-r2

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    all

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kibana-7

    all

  • chainguard•kibana-8.17

    < 8.17.10-r21

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r21

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r21

  • chainguard•kibana-8.19

    < 8.19.15-r0

  • chainguard•kibana-8.19-bitnami

    < 8.19.15-r0

  • chainguard•kibana-8.19-iamguarded

    < 8.19.15-r0

  • chainguard•kibana-9.0

    < 9.0.8-r25

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r25

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r25

  • chainguard•kibana-9.1

    < 9.1.10-r15 | < 9.1.10-r17

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r15 | < 9.1.10-r17

  • chainguard•kibana-9.2

    < 9.2.8-r3

  • chainguard•kibana-9.2-iamguarded

    < 9.2.8-r3

  • chainguard•kibana-9.3

    < 9.3.4-r4

  • chainguard•kibana-9.3-iamguarded

    < 9.3.4-r4

  • chainguard•kibana-9.4

    < 9.4.2-r0

  • chainguard•kibana-9.4-iamguarded

    < 9.4.2-r0

  • chainguard•kubeflow-pipelines-frontend

    < 2.16.1-r1

  • chainguard•langfuse-2

    < 2.95.12-r23

  • chainguard•langfuse-2-worker

    < 2.95.12-r23

  • chainguard•langfuse-3

    < 3.174.1-r0

  • chainguard•langfuse-3-worker

    < 3.174.1-r0

  • chainguard•langfuse-fips-2

    < 2.95.12-r25

  • chainguard•langfuse-fips-2-worker

    < 2.95.12-r25

  • chainguard•langfuse-fips-3

    < 3.174.1-r0

  • chainguard•langfuse-fips-3-worker

    < 3.174.1-r0

  • chainguard•langfuse-fips-3.152

    all

  • chainguard•langfuse-fips-3.152-worker

    all

Showing first 50 affected entries in server-rendered view.

References (38)