The Red Hat security advisory RHSA-2026:51200 reports a cross-site scripting (XSS) vulnerability (CVE-2026-42338) in the ip-address JavaScript library used by Red Hat Satellite Lightspeed. The vulnerability arises when untrusted input is passed to the Address6 constructor and output from methods like Address6.group(), Address6.link(), or AddressError.parseMessage is rendered as HTML without proper escaping, enabling execution of attacker-controlled scripts in users' browsers. This can lead to disclosure of sensitive information such as cookies and session data. The advisory also references two additional CVEs (CVE-2026-59873 and CVE-2026-59874) related to the same context. The affected versions include Red Hat Satellite versions prior to 10.1.1. No official patch or fix meeting Red Hat's criteria is currently available, and mitigation options are limited. The vulnerability requires specific application-level rendering conditions to be exploitable, which may not be common in Red Hat products. The advisory provides updated container images for remediation and links to documentation for installation and configuration.

The vulnerability allows remote attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts through untrusted input processed by the Address6 constructor. Successful exploitation can lead to unauthorized execution of scripts in users' browsers, potentially resulting in disclosure of sensitive information such as session cookies, user data, and the ability to perform actions on behalf of the user. The impact is rated as high due to the confidentiality and integrity risks, although availability is not affected. Exploitation depends on specific application rendering practices that may not be widespread in Red Hat products. There are no known exploits in the wild at this time.

Currently, there is no official patch or fix available that meets Red Hat's criteria for ease of use, applicability, or stability. Users are advised to follow Red Hat Satellite documentation for installing and configuring Red Hat Lightspeed in Satellite, including deploying the updated satellite/iop-remediations-rhel9 container image available in the Red Hat container registry. Mitigation depends on ensuring that applications do not render unescaped output from the Address6 constructor methods as HTML. Monitoring Red Hat advisories for future updates or patches is recommended.