The library exposes a client‑side XSS vulnerability. The Address6.group(), Address6.link(), and certain error outputs build HTML strings that are returned to the caller without escaping any data that could originate from a user. An application that passes untrusted input to these methods and then injects the returned markup into a page using innerHTML or a similar technique can execute arbitrary JavaScript in the user’s browser. The flaw is a classic DOM‑based XSS identified as CWE‑79. No direct exploitation code is supplied; the impact depends on the consuming application’s rendering logic.

The affected component is the JavaScript library ip-address developed by beaugunderson. Versions prior to 10.1.1 are vulnerable. Any project that incorporates or depends on these versions, whether on the server side or client side, is potentially exposed.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented yet. The likely attack vector is through a web application that integrates the library and renders its output as raw HTML – for example, inserting the output of Address6.group() or Address6.link() into a DOM element via innerHTML. An attacker would need to supply crafted input that contains the desired script payload and then trigger the rendering of the unescaped content to compromise the victim’s browser. The vulnerability does not require privileged access or extra execution beyond the client’s context.