All vulnerabilities
CVE-2024-11831GHSA-76p7-773f-r4q5

Cross-site Scripting (XSS) in serialize-javascript

serialize-javascriptnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.12%Chance of exploitation activity in the next 30 days, higher than 65% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.0.2Fixed versionGitHub
Published10 Feb 2025Updated 22 Oct 2026CVE List

What fixes it

  • 6.0.2serialize-javascript, npmGitHubnpm install serialize-javascript@6.0.2
  • 6.0.2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Text from CVE List

Affected versions 31

  • serialize-javascript, npm>= 6.0.0, < 6.0.2GitHub
  • Productaffected: 6.0 before 6.0.2CVE List
  • Red Hat Advanced Cluster Security 4.4unaffected: 4.4.8-2 and laterCVE List
  • Red Hat Advanced Cluster Security 4.5unaffected: 4.5.6-2 and laterCVE List
  • Red Hat Ceph Storage 7.1unaffected: 2:18.2.1-381.el8cp and laterCVE List
  • Red Hat Ceph Storage 8.1unaffected: 2:19.2.1-292.el9cp and laterCVE List
  • Red Hat Ceph Storage 9.0unaffected: 2:20.1.0-144.el10cp and laterCVE List
  • Red Hat Enterprise Linux 8unaffected: 0:8.0.112-1.el8_10 and laterCVE List
  • Red Hat Enterprise Linux 9unaffected: 0:8.0.112-1.el9_5 and laterCVE List
  • RHODF-4.14-RHEL-9unaffected: v4.14.18-2 and laterCVE List
  • RHODF-4.14-RHEL-9unaffected: v4.14.18-3 and laterCVE List
  • RHODF-4.15-RHEL-9unaffected: v4.15.14-2 and laterCVE List
  • RHODF-4.16-RHEL-9unaffected: v4.16.10-4 and laterCVE List
  • RHODF-4.16-RHEL-9unaffected: v4.16.10-3 and laterCVE List
  • RHODF-4.17-RHEL-9unaffected: v4.17.7-2 and laterCVE List
  • RHODF-4.18-RHEL-9unaffected: v4.18.2-8 and laterCVE List
  • RHODF-4.18-RHEL-9unaffected: v4.18.2-7 and laterCVE List
  • Red Hat Ceph Storage 7.1unaffected: 1791452477 and laterCVE List
  • Red Hat Ceph Storage 8unaffected: 8 and laterCVE List
  • Red Hat Ceph Storage 8.1unaffected: 1787550654 and laterCVE List
  • Red Hat Ceph Storage 9.0unaffected: 1776359884 and laterCVE List
  • Red Hat OpenShift Pipelines 1.14.6unaffected: v1.14.6-1744143767 and laterCVE List
  • Red Hat OpenShift Pipelines 1.15unaffected: v1.15.3-1746939886 and laterCVE List
  • Red Hat OpenShift Pipelines 1.15unaffected: v1.15.3-1746936251 and laterCVE List
  • Red Hat OpenShift Pipelines 1.16unaffected: v1.16.4-1747983385 and laterCVE List
  • Red Hat OpenShift Pipelines 1.16unaffected: v1.16.4-1747979846 and laterCVE List
  • Red Hat OpenShift Pipelines 1.17unaffected: v1.17.2-1749452800 and laterCVE List
  • Red Hat OpenShift Pipelines 1.17unaffected: v1.17.2-1750066936 and laterCVE List
  • Red Hat OpenShift Pipelines 1.18.0unaffected: v1.18.1-1747749913 and laterCVE List
  • Red Hat OpenShift Pipelines 1.19unaffected: v1.19.0-1752127853 and laterCVE List
  • serialize-javascript, npmfrom 6.0.0, fixed in 6.0.2OSV

References 29