CVE-2026-41575 Overview
CVE-2026-41575 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the th30d4y/IP Reputation Checker application, a Node.js project also known as w4nn4d13/ip. The flaw affects versions 1.0.1 through versions prior to 2.0.1. Unsanitized user-supplied input is rendered directly into the Document Object Model (DOM) by the application's client-side code. Attackers can craft input that executes arbitrary JavaScript in the browser of any user who interacts with a malicious payload. The maintainer has patched the issue in version 2.0.1 per the GitHub Security Advisory.
Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in a victim's browser, enabling session theft, credential capture, and unauthorized actions in the application's context.
Affected Products
- th30d4y/IP (also referenced as w4nn4d13/ip), Node.js component
- Versions 1.0.1 through versions prior to 2.0.1
- Fixed release: 2.0.1
Discovery Timeline
- 2026-05-08 - CVE-2026-41575 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-41575
Vulnerability Analysis
The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The IP Reputation Checker accepts user-controlled input, such as an IP address or search term, and writes that value directly into the page's DOM without sanitization or encoding. Because the rendering happens entirely on the client side, the attack does not require server-side reflection. The exploit requires user interaction, meaning a victim must visit a crafted URL or load attacker-supplied content. Successful execution runs in the browser context of the target user and can pivot to data theft or impersonation.
Root Cause
Client-side JavaScript writes attacker-controllable values into the DOM using sinks such as innerHTML, document.write, or unsafe template interpolation. The application does not apply output encoding or use safe sink alternatives such as textContent. Any payload included in the input source flows directly to the rendering sink, allowing script injection.
Attack Vector
An attacker crafts a URL or input containing an HTML/JavaScript payload and delivers it to a victim through phishing, a shared link, or an embedded redirect. When the victim loads the page, the application reads the malicious value and injects it into the DOM. The script then executes with the privileges of the victim's session, where it can read cookies not flagged HttpOnly, exfiltrate page data, or perform actions on behalf of the user.
No verified public proof-of-concept code is currently available. Refer to the GitHub Security Advisory GHSA-j7wv-7j97-9qh9 for vendor-provided details.
Detection Methods for CVE-2026-41575
Indicators of Compromise
- Requests to the IP Reputation Checker containing URL fragments or query parameters with HTML tags, javascript: URIs, or encoded <script> payloads.
- Browser console errors or Content Security Policy (CSP) violation reports referencing inline script execution on application pages.
- Outbound requests from client browsers to unexpected domains immediately after loading the application.
Detection Strategies
- Inspect web server and reverse proxy logs for suspicious parameters containing <, >, onerror=, onload=, or encoded variants such as %3Cscript%3E.
- Deploy a Content Security Policy in report-only mode and review violations associated with inline scripts on application routes.
- Use static analysis tooling to flag dangerous DOM sinks (innerHTML, outerHTML, document.write) that consume user input.
Monitoring Recommendations
- Monitor browser telemetry and Real User Monitoring (RUM) data for anomalous script errors tied to the application.
- Alert on URL referrers containing encoded HTML or JavaScript syntax pointing to the IP Reputation Checker.
- Track installations of th30d4y/IP versions below 2.0.1 across internal Node.js inventories.
How to Mitigate CVE-2026-41575
Immediate Actions Required
- Upgrade th30d4y/IP to version 2.0.1 or later in all environments hosting the IP Reputation Checker.
- Audit recent application logs for malicious input patterns and rotate any session tokens that may have been exposed.
- Restrict access to the application behind authentication while the upgrade is rolled out.
Patch Information
The maintainer addressed the issue in version 2.0.1. Details are published in the GitHub Security Advisory GHSA-j7wv-7j97-9qh9. Update the dependency through your package manager and redeploy the application.
Workarounds
- Enforce a strict Content Security Policy that blocks inline scripts and disallows unsafe-inline and unsafe-eval.
- Place the application behind a Web Application Firewall (WAF) rule set that filters XSS payloads in query strings and URL fragments.
- Replace unsafe DOM sinks in custom forks with textContent or framework-provided escaping helpers until the upgrade is applied.
# Update th30d4y/IP to the patched release
npm install th30d4y/IP@2.0.1
npm ls th30d4y/IP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
