[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-42338":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":54,"duplicate_of":9,"upstream":56,"downstream":57,"duplicates":90,"related":91,"reserved_at":9,"published_at":102,"modified_at":103,"state":104,"summary":105,"references_raw":113,"kevs":218,"epss":219,"epss_history":222,"metrics":384,"affected":403},"CVE-2026-42338","ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],[45],{"_key":46,"name":47,"source":48,"url":49,"maturity":50,"reliability_score":51,"verified":52,"type":9,"platforms":53,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_BEAUGUNDERSON_IP-ADDRESS","Ip Address","github","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","poc",0.3,false,[],[55],"GHSA-v2v4-37r5-5v8g",[],[58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88],{"_key":59},"DEBIAN-CVE-2026-42338",{"_key":61},"SUSE-SU-2026:2633-1",{"_key":63},"OPENSUSE-SU-2026:11121-1",{"_key":65},"SUSE-SU-2026:2647-1",{"_key":67},"SUSE-SU-2026:22368-1",{"_key":69},"SUSE-SU-2026:2695-1",{"_key":71},"UBUNTU-CVE-2026-42338",{"_key":73},"OPENSUSE-SU-2026:21058-1",{"_key":75},"OPENSUSE-SU-2026:21236-1",{"_key":77},"SUSE-SU-2026:22565-1",{"_key":79},"RHSA-2026:35841",{"_key":81},"RHSA-2026:35842",{"_key":83},"RHSA-2026:35891",{"_key":85},"RHSA-2026:35892",{"_key":87},"RHSA-2026:39246",{"_key":89},"RHSA-2026:39868",[],[92,93,94,95,96,97,98,99,100],{"_key":61},{"_key":63},{"_key":65},{"_key":67},{"_key":69},{"_key":73},{"_key":75},{"_key":77},{"_key":101},"CGA-R267-PX9W-2F4F","2026-05-12T19:43:16.470Z","2026-07-21T12:05:00.460Z","Analyzed",{"cisa_kev":52,"cisa_ransomware":52,"cisa_vendor":9,"epss_severity":106,"epss_score":107,"severity":108,"severity_score":109,"severity_version":110,"severity_source":111,"severity_vector":112,"severity_status":104},"low",0.00453,"high",8.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",[114,124,129,134,140,145,150,154,158,162,166,170,174,178,182,186,190,194,198,202,206,210,214],{"url":49,"sources":115,"tags":118},[116,111,117],"osv_npm","nvd",[119,120,121,122,123],"WEB","X Refsource CONFIRM","Exploit","Mitigation","Vendor Advisory",{"url":125,"sources":126,"tags":127},"https://github.com/beaugunderson/ip-address",[116],[128],"PACKAGE",{"url":130,"sources":131,"tags":132},"https://nvd.nist.gov/vuln/detail/CVE-2026-42338",[116],[133],"Advisory",{"url":135,"sources":136,"tags":137},"https://access.redhat.com/security/cve/CVE-2026-42338",[111],[138,139],"VDB Entry","X Refsource REDHAT",{"url":141,"sources":142,"tags":143},"https://bugzilla.redhat.com/show_bug.cgi?id=2476810",[111],[144,139],"Issue Tracking",{"url":146,"sources":147,"tags":148},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42338.json",[111],[149],"X Sadp Csaf Vex",{"url":151,"sources":152,"tags":153},"https://access.redhat.com/errata/RHSA-2026:33155",[111],[123,139],{"url":155,"sources":156,"tags":157},"https://access.redhat.com/errata/RHSA-2026:33160",[111],[123,139],{"url":159,"sources":160,"tags":161},"https://access.redhat.com/errata/RHSA-2026:33163",[111],[123,139],{"url":163,"sources":164,"tags":165},"https://access.redhat.com/errata/RHSA-2026:33173",[111],[123,139],{"url":167,"sources":168,"tags":169},"https://access.redhat.com/errata/RHSA-2026:33183",[111],[123,139],{"url":171,"sources":172,"tags":173},"https://access.redhat.com/errata/RHSA-2026:35842",[111],[123,139],{"url":175,"sources":176,"tags":177},"https://access.redhat.com/errata/RHSA-2026:35841",[111],[123,139],{"url":179,"sources":180,"tags":181},"https://access.redhat.com/errata/RHSA-2026:35892",[111],[123,139],{"url":183,"sources":184,"tags":185},"https://access.redhat.com/errata/RHSA-2026:35891",[111],[123,139],{"url":187,"sources":188,"tags":189},"https://access.redhat.com/errata/RHSA-2026:34374",[111],[123,139],{"url":191,"sources":192,"tags":193},"https://access.redhat.com/errata/RHSA-2026:33574",[111],[123,139],{"url":195,"sources":196,"tags":197},"https://access.redhat.com/errata/RHSA-2026:36754",[111],[123,139],{"url":199,"sources":200,"tags":201},"https://access.redhat.com/errata/RHSA-2026:36820",[111],[123,139],{"url":203,"sources":204,"tags":205},"https://access.redhat.com/errata/RHSA-2026:39246",[111],[123,139],{"url":207,"sources":208,"tags":209},"https://access.redhat.com/errata/RHSA-2026:39868",[111],[123,139],{"url":211,"sources":212,"tags":213},"https://access.redhat.com/errata/RHSA-2026:41947",[111],[123,139],{"url":215,"sources":216,"tags":217},"https://access.redhat.com/errata/RHSA-2026:41928",[111],[123,139],[],{"date":220,"score":107,"percentile":221},"2026-07-05",0.36286,[223,227,230,233,236,239,243,246,250,253,257,260,263,266,269,271,274,277,280,283,286,289,292,294,297,300,302,305,308,310,312,314,318,321,325,328,331,334,337,340,343,346,349,352,355,358,361,364,367,371,374,377,380,383],{"date":224,"score":225,"percentile":226},"2026-05-13",0.00054,0.16888,{"date":228,"score":225,"percentile":229},"2026-05-14",0.16933,{"date":231,"score":225,"percentile":232},"2026-05-15",0.16931,{"date":234,"score":225,"percentile":235},"2026-05-16",0.16942,{"date":237,"score":225,"percentile":238},"2026-05-17",0.16919,{"date":240,"score":241,"percentile":242},"2026-05-18",0.00071,0.21592,{"date":244,"score":241,"percentile":245},"2026-05-19",0.21583,{"date":247,"score":248,"percentile":249},"2026-05-20",0.00036,0.10688,{"date":251,"score":248,"percentile":252},"2026-05-21",0.10658,{"date":254,"score":255,"percentile":256},"2026-05-22",0.00012,0.01667,{"date":258,"score":255,"percentile":259},"2026-05-23",0.01664,{"date":261,"score":255,"percentile":262},"2026-05-24",0.01669,{"date":264,"score":255,"percentile":265},"2026-05-25",0.01662,{"date":267,"score":255,"percentile":268},"2026-05-26",0.01655,{"date":270,"score":255,"percentile":262},"2026-05-27",{"date":272,"score":255,"percentile":273},"2026-05-28",0.01665,{"date":275,"score":255,"percentile":276},"2026-05-29",0.01675,{"date":278,"score":255,"percentile":279},"2026-05-30",0.01677,{"date":281,"score":255,"percentile":282},"2026-05-31",0.01674,{"date":284,"score":255,"percentile":285},"2026-06-01",0.01658,{"date":287,"score":255,"percentile":288},"2026-06-02",0.01653,{"date":290,"score":255,"percentile":291},"2026-06-03",0.01647,{"date":293,"score":255,"percentile":291},"2026-06-04",{"date":295,"score":255,"percentile":296},"2026-06-05",0.01657,{"date":298,"score":255,"percentile":299},"2026-06-06",0.01663,{"date":301,"score":255,"percentile":265},"2026-06-07",{"date":303,"score":255,"percentile":304},"2026-06-08",0.01654,{"date":306,"score":255,"percentile":307},"2026-06-09",0.0165,{"date":309,"score":255,"percentile":291},"2026-06-10",{"date":311,"score":255,"percentile":288},"2026-06-11",{"date":313,"score":255,"percentile":296},"2026-06-12",{"date":315,"score":316,"percentile":317},"2026-06-13",0.00013,0.02022,{"date":319,"score":316,"percentile":320},"2026-06-14",0.0203,{"date":322,"score":323,"percentile":324},"2026-06-15",0.00258,0.16886,{"date":326,"score":323,"percentile":327},"2026-06-16",0.16909,{"date":329,"score":323,"percentile":330},"2026-06-17",0.16917,{"date":332,"score":323,"percentile":333},"2026-06-18",0.1693,{"date":335,"score":323,"percentile":336},"2026-06-19",0.16916,{"date":338,"score":323,"percentile":339},"2026-06-20",0.16905,{"date":341,"score":323,"percentile":342},"2026-06-21",0.16895,{"date":344,"score":323,"percentile":345},"2026-06-22",0.16878,{"date":347,"score":323,"percentile":348},"2026-06-23",0.16915,{"date":350,"score":323,"percentile":351},"2026-06-24",0.16943,{"date":353,"score":323,"percentile":354},"2026-06-25",0.17038,{"date":356,"score":323,"percentile":357},"2026-06-26",0.17069,{"date":359,"score":323,"percentile":360},"2026-06-27",0.17104,{"date":362,"score":323,"percentile":363},"2026-06-28",0.17068,{"date":365,"score":323,"percentile":366},"2026-06-29",0.17063,{"date":368,"score":369,"percentile":370},"2026-06-30",0.00441,0.35271,{"date":372,"score":369,"percentile":373},"2026-07-01",0.35374,{"date":375,"score":107,"percentile":376},"2026-07-02",0.36235,{"date":378,"score":107,"percentile":379},"2026-07-03",0.36252,{"date":381,"score":107,"percentile":382},"2026-07-04",0.36266,{"date":220,"score":107,"percentile":221},[385,389,396],{"source":116,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":386},{"baseScore":387,"baseSeverity":9,"vectorString":388,"impactScore":9,"exploitabilityScore":9},5.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",{"source":111,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":390,"cvss_v4_0":394},{"baseScore":109,"baseSeverity":391,"vectorString":112,"impactScore":392,"exploitabilityScore":393},"HIGH",8.7,7.2,{"baseScore":387,"baseSeverity":395,"vectorString":388,"impactScore":9,"exploitabilityScore":9},"MEDIUM",{"source":117,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":397,"cvss_v4_0":401},{"baseScore":398,"baseSeverity":395,"vectorString":399,"impactScore":400,"exploitabilityScore":393},6.1,"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",4.5,{"baseScore":387,"baseSeverity":395,"vectorString":402,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[404,415],{"ecosystem":9,"name":405,"vendor":406,"product":405,"cpe_part":407,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":408},"ip-address","beaugunderson","a",[409],{"version":410,"is_range":411,"range_type":412,"version_start":9,"version_start_type":9,"version_end":413,"version_end_type":414,"fixed_in":9},"\u003C 10.1.1",true,"cpe","10.1.1","excluding",{"ecosystem":416,"name":405,"vendor":416,"product":405,"cpe_part":9,"purl_type":417,"purl_namespace":9,"purl_name":405,"source":9,"versions":418},"Npm","npm",[419],{"version":420,"is_range":411,"range_type":421,"version_start":9,"version_start_type":9,"version_end":413,"version_end_type":414,"fixed_in":9},"lt10_1_1","semver"]