Executive brief
The ip-address library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, contains a vulnerability that could allow for cross-site scripting (XSS). If an application processes untrusted input using certain library methods and then displays the results as HTML, an attacker could execute malicious scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the ip-address library due to a failure to properly HTML-escape attacker-controlled content in several methods, including Address6.group(), Address6.link(), and AddressError.parseMessage. Specifically, the Address6.group() method fails to escape IPv6 zone identifiers, and Address6.link() allows for attribute-value injection via user-supplied prefix and className options. Additionally, the Address6 constructor can leak unescaped content into error messages during certain IPv4-in-IPv6 parsing failures. An attacker can exploit this by providing a crafted IP address string containing HTML or JavaScript. If the application subsequently renders the library's output using methods like innerHTML, the script will execute in the victim's browser context. The issue is fixed in version 10.1.1.
Affected products
- beaugunderson ip-address < 10.1.1
Timeline
- 2026-04-27: advisory: GitHub security advisory published by maintainer
- 2026-05-12: disclosed: CVE published to NVD