Log in Start free

Vulnerability · Published Feb 10, 2025 · Assigned by redhat

CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Medium 5.4

In plain English

A medium-severity cross-site scripting in serialize-javascript. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aspnetcore-runtime-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8aspnetcore-runtime-dbg-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-apphost-pack-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-hostfxr-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-runtime-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-runtime-dbg-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-sdk-8.08.0.112-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.112-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-sdk-dbg-8.08.0.112-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-targeting-pack-8.08.0.12-1.el8_10ALSA-2025:0381
AlmaLinux:8dotnet-templates-8.08.0.112-1.el8_10ALSA-2025:0381
Debian:12node-serialize-javascript6.0.0-2+deb12u1DEBIAN-CVE-2024-11831
Debian:13node-serialize-javascript6.0.2-1DEBIAN-CVE-2024-11831
Debian:14node-serialize-javascript6.0.2-1DEBIAN-CVE-2024-11831
Ubuntu:22.04:LTSnode-serialize-javascriptno fix listedUBUNTU-CVE-2024-11831
Ubuntu:24.04:LTSnode-serialize-javascriptno fix listedUBUNTU-CVE-2024-11831
Ubuntu:25.10node-serialize-javascriptno fix listedUBUNTU-CVE-2024-11831
Ubuntu:26.04:LTSnode-serialize-javascriptno fix listedUBUNTU-CVE-2024-11831
Ubuntu:26.10node-serialize-javascriptno fix listedUBUNTU-CVE-2024-11831
npmserialize-javascript6.0.2GHSA-76p7-773f-r4q5

Affected products (as reported)

VendorProductVersions
serialize-javascript 6.0 – before 6.0.2
Red Hat Red Hat Advanced Cluster Security 4.4 see references
Red Hat Red Hat Advanced Cluster Security 4.5 see references
Red Hat Red Hat Ceph Storage 7.1 see references
Red Hat Red Hat Ceph Storage 8.1 see references
Red Hat Red Hat Ceph Storage 9.0 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat RHODF-4.14-RHEL-9 see references
Red Hat RHODF-4.14-RHEL-9 see references
Red Hat RHODF-4.14-RHEL-9 see references
Red Hat RHODF-4.15-RHEL-9 see references
Red Hat RHODF-4.15-RHEL-9 see references
Red Hat RHODF-4.15-RHEL-9 see references
Red Hat RHODF-4.16-RHEL-9 see references
Red Hat RHODF-4.16-RHEL-9 see references
Red Hat RHODF-4.16-RHEL-9 see references
Red Hat RHODF-4.17-RHEL-9 see references
Red Hat RHODF-4.17-RHEL-9 see references
Red Hat RHODF-4.17-RHEL-9 see references
Red Hat RHODF-4.18-RHEL-9 see references
Red Hat RHODF-4.18-RHEL-9 see references
Red Hat RHODF-4.18-RHEL-9 see references
Red Hat Red Hat Ceph Storage 7.1 see references
Red Hat Red Hat Ceph Storage 8 see references
Red Hat Red Hat Ceph Storage 8.1 see references
Red Hat Red Hat Ceph Storage 9.0 see references
Red Hat Red Hat OpenShift Pipelines 1.14.6 see references
Red Hat Red Hat OpenShift Pipelines 1.15 see references
Red Hat Red Hat OpenShift Pipelines 1.15 see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References