GHSA-76p7-773f-r4q5
Cross-site Scripting (XSS) in serialize-javascript
At a glance
- Published
- Updated
- CVE
- CVE-2024-11831
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Affected packages
| Package | Versions |
|---|---|
| npm · serialize-javascript | introduced 6.0.0, fixed 6.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-11831 ADVISORY
- https://github.com/yahoo/serialize-javascript/pull/173 WEB
- https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e WEB
- https://github.com/yahoo/serialize-javascript/commit/7f3ac252d86b802454cb43782820aea2e0f6dc25 WEB
- https://github.com/yahoo/serialize-javascript PACKAGE
- https://bugzilla.redhat.com/show_bug.cgi?id=2312579 WEB
- https://access.redhat.com/security/cve/CVE-2024-11831 WEB
- https://access.redhat.com/errata/RHSA-2026:8568 WEB
- https://access.redhat.com/errata/RHSA-2026:83548 WEB
- https://access.redhat.com/errata/RHSA-2026:62115 WEB
- https://access.redhat.com/errata/RHSA-2026:2769 WEB
- https://access.redhat.com/errata/RHSA-2026:1536 WEB
- https://access.redhat.com/errata/RHSA-2025:9294 WEB
- https://access.redhat.com/errata/RHSA-2025:8551 WEB
- https://access.redhat.com/errata/RHSA-2025:8544 WEB
- https://access.redhat.com/errata/RHSA-2025:8512 WEB
- https://access.redhat.com/errata/RHSA-2025:8479 WEB
- https://access.redhat.com/errata/RHSA-2025:8233 WEB
- https://access.redhat.com/errata/RHSA-2025:8078 WEB
- https://access.redhat.com/errata/RHSA-2025:8059 WEB
- https://access.redhat.com/errata/RHSA-2025:4511 WEB
- https://access.redhat.com/errata/RHSA-2025:3870 WEB
- https://access.redhat.com/errata/RHSA-2025:21203 WEB
- https://access.redhat.com/errata/RHSA-2025:21068 WEB
- https://access.redhat.com/errata/RHSA-2025:1468 WEB
- https://access.redhat.com/errata/RHSA-2025:1334 WEB
- https://access.redhat.com/errata/RHSA-2025:10853 WEB
- https://access.redhat.com/errata/RHSA-2025:0381 WEB
- https://access.redhat.com/errata/RHBA-2025:0304 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |