Към съдържанието
Търсене

CVE-2026-42338: beaugunderson ip-address, XSS

8.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и след действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Засегнати продукти

  • beaugunderson ip-address: < 10.1.1
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Enterprise Linux 10: 1:24.18.0-1.el10_2 преди *
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: 1:22.23.1-2.el10_0 преди *
  • Red Hat Red Hat Enterprise Linux 8: 8100020260630152626.6d880403 преди *
  • Red Hat Red Hat Enterprise Linux 9: 9080020260626074955.rhel9 преди *
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: 9060020260804140259.rhel9 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6: 1782721130 преди *
  • Red Hat Red Hat Developer Hub 1.10: 1783448184 преди *
  • Red Hat Red Hat Developer Hub 1.9: 1782761244 преди *
  • Red Hat Red Hat Enterprise Linux AI 3.3: 1788290314 преди *
  • Red Hat Red Hat Migration Toolkit 1.8: 1783690532 преди *
  • Red Hat Red Hat OpenShift AI 2.25: 1787801527 преди *
  • Red Hat Red Hat OpenShift AI 3.4: 1787121387 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.20: 1784724699 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.21: 1784713741 преди *
  • Red Hat Red Hat OpenShift Container Platform 4.22: 1784721581 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.22: 1787057250 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.29: 1782498475 преди *
  • Red Hat Red Hat OpenShift Service Mesh 2.6: 1781937133 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.0: 1782201894 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.1: 1782201696 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.2: 1782201851 преди *
  • Red Hat Red Hat OpenShift Service Mesh 3.3: 1782231869 преди *
  • Red Hat Red Hat Satellite 6.19: 1786008041 преди *
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat Exploit Intelligence
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat OpenShift Pipelines
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Build of Podman Desktop
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Self-service automation portal 2

Вид слабост

История

  • 12 май 2026 Публикувано

Други уязвимости в beaugunderson ip-address

Първоизточници

CVE-2026-42338: beaugunderson ip-address, XSS | freedomonline.bg