Red Hat Product Security issued advisory RHSA-2026:51200 concerning vulnerabilities including CVE-2026-42338 in the ip-address JavaScript library, which is used by Red Hat Lightspeed in Satellite. The vulnerability allows remote attackers to perform cross-site scripting (XSS) by supplying untrusted input to the Address6 constructor. If an application renders the output of Address6.group(), Address6.link(), or AddressError.parseMessage as HTML without proper escaping, attacker-controlled scripts can execute in the user's browser. Exploitation requires specific application rendering behavior that may not be common in Red Hat products. The advisory also references two additional CVEs (CVE-2026-59873 and CVE-2026-59874) but does not detail them. No patch or official fix is currently available that meets Red Hat's standards. The advisory includes a new container image for remediation purposes but does not address the underlying vulnerabilities directly.

The vulnerability enables cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in the context of a user's browser. This can lead to disclosure of sensitive information such as cookies and session tokens, unauthorized actions performed on behalf of the user, and compromise of user data confidentiality and integrity. However, exploitation depends on how applications render the vulnerable library's output, which may limit the practical impact in Red Hat products. No known exploits are reported in the wild at this time.

Currently, there is no official patch or fix available that meets Red Hat's criteria for ease of deployment and applicability. Users are advised to review application code to ensure that any output from the ip-address library, especially from Address6 methods, is properly escaped before rendering as HTML. Red Hat provides a new satellite/iop-remediations-rhel9 container image for remediation purposes, but it does not fix the underlying vulnerabilities. Users should monitor Red Hat advisories for future updates and consider upgrading affected components when fixes become available.