The ip-address library performs containment checks in its isInSubnet and isHostInSubnet functions by comparing masked binary strings of IP addresses. However, it does not enforce that both operands belong to the same IP family. This flaw means that a cross‑family address comparison can succeed if the leading bits match, causing the function to return true even though the addresses are of different families. An application relying on these functions for allowlist or denylist decisions could therefore be tricked into allowing traffic from addresses that lie outside the intended subnet. The weakness is described by CWE‑1024, CWE‑697 and CWE‑843 and can lead to unauthorized access or privilege escalation in systems that trust the library for network filtering.

The vulnerability affects the ip-address library from beaugunderson. All applications using versions prior to 10.7.1 are impacted. The fix is included in release 10.7.1.

The CVSS base score of 6.3 indicates a moderate severity. Because the flawed logic is triggered by user‑supplied addresses, an attacker can construct a malicious IP that will be incorrectly accepted. The flaw aligns with CWE‑1024, as well as the listed CWEs. The EPSS score is 0.0037 (< 1%), indicating a low exploitation probability. No known exploitation in the wild, so the likelihood remains uncertain. The vulnerability is not listed in CISA’s KEV catalog. If the library is used in an allowlist or denylist context, the conditions for exploitation are relatively easy to satisfy by feeding malicious IP strings to the function.