The ip-address JavaScript library versions before 10.1.1 contain an XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, Address6.group(), Address6.link(), and AddressError.parseMessage can include unescaped attacker-controlled content in their HTML output. If an application uses these methods and renders their output directly as HTML (e.g., via innerHTML), it may allow execution of malicious scripts in the user's browser. The vulnerability is fixed in version 10.1.1. Exploitation depends on application-level rendering practices. The CVSS v4.0 base score is 5.3 (medium severity).

Successful exploitation can lead to cross-site scripting attacks, allowing an attacker to execute arbitrary scripts in the context of the victim's browser. This can result in disclosure of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of the user, and potential compromise of user accounts. The vulnerability does not directly allow code execution on the server or affect availability. Exploitation requires that the vulnerable library output is rendered as HTML without proper escaping.

A fix is available in ip-address version 10.1.1. Users should upgrade to version 10.1.1 or later to remediate this vulnerability. The vendor advisory notes that mitigation options other than upgrading may not meet security criteria. Applications should ensure that any output from Address6 methods or AddressError.parseMessage is properly escaped before rendering as HTML. Red Hat has released security updates including this fix in nodejs22 packages for Red Hat Enterprise Linux 10.0 Extended Update Support.