CVE-2024-11831

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

State: Published
Severity: 5.4 Medium
Published: Feb 10, 2025
Updated: Nov 1, 2026
Reserved: Nov 26, 2024

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	redhat

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

Product	Versions
serialize-javascript	6.0 to before 6.0.2Affected
Red Hat Advanced Cluster Security 4.4Red Hat	4.4.8-2 and laterNot affected
Red Hat Advanced Cluster Security 4.5Red Hat	4.5.6-2 and laterNot affected
Red Hat Ceph Storage 7.1Red Hat	2:18.2.1-381.el8cp and laterNot affected
Red Hat Ceph Storage 8.1Red Hat	2:19.2.1-292.el9cp and laterNot affected
Red Hat Ceph Storage 9.0Red Hat	2:20.1.0-144.el10cp and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:8.0.112-1.el8_10 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:8.0.112-1.el9_5 and laterNot affected
RHODF-4.14-RHEL-9Red Hat	v4.14.18-2 and laterNot affected
RHODF-4.14-RHEL-9Red Hat	v4.14.18-3 and laterNot affected
RHODF-4.14-RHEL-9Red Hat	v4.14.18-2 and laterNot affected
RHODF-4.15-RHEL-9Red Hat	v4.15.14-2 and laterNot affected
RHODF-4.15-RHEL-9Red Hat	v4.15.14-2 and laterNot affected
RHODF-4.15-RHEL-9Red Hat	v4.15.14-2 and laterNot affected
RHODF-4.16-RHEL-9Red Hat	v4.16.10-4 and laterNot affected
RHODF-4.16-RHEL-9Red Hat	v4.16.10-4 and laterNot affected
RHODF-4.16-RHEL-9Red Hat	v4.16.10-3 and laterNot affected
RHODF-4.17-RHEL-9Red Hat	v4.17.7-2 and laterNot affected
RHODF-4.17-RHEL-9Red Hat	v4.17.7-2 and laterNot affected
RHODF-4.17-RHEL-9Red Hat	v4.17.7-2 and laterNot affected
RHODF-4.18-RHEL-9Red Hat	v4.18.2-8 and laterNot affected
RHODF-4.18-RHEL-9Red Hat	v4.18.2-7 and laterNot affected
RHODF-4.18-RHEL-9Red Hat	v4.18.2-8 and laterNot affected
Red Hat Ceph Storage 7.1Red Hat	1791452477 and laterNot affected
Red Hat Ceph Storage 8Red Hat	8 and laterNot affected
Red Hat Ceph Storage 8.1Red Hat	1787550654 and laterNot affected
Red Hat Ceph Storage 9.0Red Hat	1776359884 and laterNot affected
Red Hat OpenShift Pipelines 1.14.6Red Hat	v1.14.6-1744143767 and laterNot affected
Red Hat OpenShift Pipelines 1.15Red Hat	v1.15.3-1746939886 and laterNot affected
Red Hat OpenShift Pipelines 1.15Red Hat	v1.15.3-1746936251 and laterNot affected
Red Hat OpenShift Pipelines 1.16Red Hat	v1.16.4-1747983385 and laterNot affected
Red Hat OpenShift Pipelines 1.16Red Hat	v1.16.4-1747979846 and laterNot affected
Red Hat OpenShift Pipelines 1.17Red Hat	v1.17.2-1749452800 and laterNot affected
Red Hat OpenShift Pipelines 1.17Red Hat	v1.17.2-1750066936 and laterNot affected
Red Hat OpenShift Pipelines 1.18.0Red Hat	v1.18.1-1747749913 and laterNot affected
Red Hat OpenShift Pipelines 1.19Red Hat	v1.19.0-1752127853 and laterNot affected
Cryostat 3Red Hat
Logging Subsystem for Red Hat OpenShiftRed Hat
Migration Toolkit for VirtualizationRed Hat
.NET 6.0 on Red Hat Enterprise LinuxRed Hat
OpenShift LightspeedRed Hat
OpenShift PipelinesRed Hat
OpenShift PipelinesRed Hat
OpenShift ServerlessRed Hat
OpenShift Service Mesh 2Red Hat
OpenShift Service Mesh 2Red Hat
Red Hat 3scale API Management Platform 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Security 4Red Hat
Red Hat Advanced Cluster Security 4Red Hat
Red Hat Advanced Cluster Security 4Red Hat
Red Hat Advanced Cluster Security 4Red Hat
Red Hat Advanced Cluster Security 4Red Hat
Red Hat Ansible Automation Platform 2Red Hat
Red Hat Ansible Automation Platform 2Red Hat
Red Hat Ansible Automation Platform 2Red Hat
Red Hat Ansible Automation Platform 2Red Hat
Red Hat build of Apache Camel - HawtIO 4Red Hat
Red Hat build of Apicurio Registry 2Red Hat
Red Hat build of OptaPlanner 8Red Hat
Red Hat Ceph Storage 7Red Hat
Red Hat Ceph Storage 7Red Hat
Red Hat Ceph Storage 7Red Hat
Red Hat Ceph Storage 8Red Hat
Red Hat Ceph Storage 8Red Hat
Red Hat Ceph Storage 8Red Hat
Red Hat Ceph Storage 9Red Hat
Red Hat Ceph Storage 9Red Hat
Red Hat Ceph Storage 9Red Hat
Red Hat Data Grid 8Red Hat
Red Hat Developer Hub 1Red Hat
Red Hat Discovery 1Red Hat
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat
Red Hat Enterprise Linux 9Red Hat
Red Hat Enterprise Linux 9Red Hat
Red Hat Fuse 7Red Hat
Red Hat Integration Camel K 1Red Hat
Red Hat JBoss Enterprise Application Platform 7Red Hat
Red Hat JBoss Enterprise Application Platform 8Red Hat
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift AI (RHOAI)Red Hat
Red Hat OpenShift Container Platform 3.11Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Dev SpacesRed Hat
Red Hat OpenShift Dev SpacesRed Hat
Red Hat OpenShift Dev SpacesRed Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat OpenShift distributed tracing 3Red Hat
Red Hat Process Automation 7Red Hat
Red Hat Quay 3Red Hat
Red Hat Satellite 6Red Hat
Red Hat Satellite 6Red Hat
Red Hat Single Sign-On 7Red Hat
Red Hat Trusted Profile AnalyzerRed Hat

References

RHBA-2025:0304vendor-advisory
RHSA-2025:0381vendor-advisory
RHSA-2025:10853vendor-advisory
RHSA-2025:1334vendor-advisory
RHSA-2025:1468vendor-advisory
RHSA-2025:21068vendor-advisory
RHSA-2025:21203vendor-advisory
RHSA-2025:3870vendor-advisory
RHSA-2025:4511vendor-advisory
RHSA-2025:8059vendor-advisory
RHSA-2025:8078vendor-advisory
RHSA-2025:8233vendor-advisory
RHSA-2025:8479vendor-advisory
RHSA-2025:8512vendor-advisory
RHSA-2025:8544vendor-advisory
RHSA-2025:8551vendor-advisory
RHSA-2025:9294vendor-advisory
RHSA-2026:1536vendor-advisory
RHSA-2026:2769vendor-advisory
RHSA-2026:62115vendor-advisory
RHSA-2026:83548vendor-advisory
RHSA-2026:8568vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-11831vdb-entry
RHBZ#2312579issue-tracking
https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e
https://github.com/yahoo/serialize-javascript/pull/173

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.