Skip to content
Fencer Vulns
medium 5.4

CVE-2024-11831 json

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

published 2025-02-10 20 mo ago modified 2026-11-05 4 d ago also GHSA-76p7-773f-r4q5 , EUVD-2025-4485

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Patch / fix

  • npm serialize-javascript 6.0.2
  • Red Hat Red Hat Advanced Cluster Security 4.4 4.4.8-2
  • Red Hat Red Hat Advanced Cluster Security 4.5 4.5.6-2
  • Red Hat Red Hat Ceph Storage 7.1 2:18.2.1-381.el8cp, 1791452477
  • Red Hat Red Hat Ceph Storage 8.1 2:19.2.1-292.el9cp, 1787550654
  • Red Hat Red Hat Ceph Storage 9.0 2:20.1.0-144.el10cp, 1776359884
  • Red Hat Red Hat Enterprise Linux 8 0:8.0.112-1.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:8.0.112-1.el9_5
  • Red Hat RHODF-4.14-RHEL-9 v4.14.18-2, v4.14.18-3
  • Red Hat RHODF-4.15-RHEL-9 v4.15.14-2
  • Red Hat RHODF-4.16-RHEL-9 v4.16.10-3, v4.16.10-4
  • Red Hat RHODF-4.17-RHEL-9 v4.17.7-2
  • Red Hat RHODF-4.18-RHEL-9 v4.18.2-7, v4.18.2-8
  • Red Hat Red Hat Ceph Storage 8 8
  • Red Hat Red Hat OpenShift Pipelines 1.14.6 v1.14.6-1744143767
  • Red Hat Red Hat OpenShift Pipelines 1.15 v1.15.3-1746936251, v1.15.3-1746939886
  • Red Hat Red Hat OpenShift Pipelines 1.16 v1.16.4-1747979846, v1.16.4-1747983385
  • Red Hat Red Hat OpenShift Pipelines 1.17 v1.17.2-1749452800, v1.17.2-1750066936
  • Red Hat Red Hat OpenShift Pipelines 1.18.0 v1.18.1-1747749913
  • Red Hat Red Hat OpenShift Pipelines 1.19 v1.19.0-1752127853
  • node-serialize-javascript Debian 12 6.0.0-2+deb12u1
  • node-serialize-javascript Debian 14, Debian 13 6.0.2-1

debian advisories DEBIAN-CVE-2024-11831

  • ceph ceph storage 7.1 2:18.2.1-381.el8cp
  • ceph ceph storage 7.1 2:18.2.1-381.el9cp
  • cephadm ceph storage 7.1 2:18.2.1-381.el9cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el9cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el8cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el9cp
  • rbd-nbd ceph storage 7.1 2:18.2.1-381.el8cp

red hat advisories RHSA-2026:2769RHSA-2026:1536RHSA-2025:21068RHBA-2025:0304RHSA-2025:0381

  • dotnet-sdk-8.0 AlmaLinux 8 8.0.112-1.el8_10
  • dotnet-hostfxr-8.0 AlmaLinux 8 8.0.12-1.el8_10
  • dotnet-runtime-8.0 AlmaLinux 8 8.0.12-1.el8_10
  • dotnet-sdk-dbg-8.0 AlmaLinux 8 8.0.112-1.el8_10
  • dotnet-templates-8.0 AlmaLinux 8 8.0.112-1.el8_10
  • aspnetcore-runtime-8.0 AlmaLinux 8 8.0.12-1.el8_10
  • dotnet-runtime-dbg-8.0 AlmaLinux 8 8.0.12-1.el8_10
  • dotnet-apphost-pack-8.0 AlmaLinux 8 8.0.12-1.el8_10

almalinux advisories ALSA-2025:0381

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-11831 updated cvss 5.4

npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript

  • Red Hat .NET 6.0 on Red Hat Enterprise Linux rh-dotnet60-dotnet, rh-dotnet60-dotnet-host, rh-dotnet60-dotnet-sdk-6.0, rh-dotnet60-dotnet-hostfxr-6.0, rh-dotnet60-dotnet-runtime-6.0, rh-dotnet60-dotnet-templates-6.0, +6 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Cryostat 3 serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat OpenShift Serverless serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8
    affected: workaround, no fix available
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 aap-cloud-ui-container, ansible-automation-platform-25/lightspeed-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 serialize-javascript
    affected: workaround, no fix available
show 25 more
  • Red Hat build of OptaPlanner 8 serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 7 libarrow, parquet-libs Red Hat Ceph Storage 8 pybind, libarrow, parquet-libs, python3-pyarrow, parquet-glib-libs, libarrow-glib-libs, +3 more Red Hat Ceph Storage 9 pybind, grafana, libarrow, parquet-libs
    affected: workaround, no fix available
  • Red Hat Data Grid 8 serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Discovery 1 discovery-server-container
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 dotnet, grafana, dotnet6.0, dotnet-host, grafana-loki, grafana-mssql, +21 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 dotnet6.0, dotnet7.0, dotnet-host, dotnet-sdk-6.0, dotnet-sdk-7.0, dotnet-hostfxr-6.0, +16 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Fuse 7 serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) odh-ml-pipelines-driver-rhel8, odh-ml-pipelines-launcher-rhel8, odh-kf-notebook-controller-rhel8, odh-ml-pipelines-api-server-v2-rhel8, odh-ml-pipelines-persistenceagent-v2-rhel8, odh-ml-pipelines-scheduledworkflow-v2-rhel8, +2 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8
    affected: workaround, no fix available
  • Red Hat Process Automation 7 serialize-javascript
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8 Red Hat Single Sign-On 7 serialize-javascript Red Hat Trusted Profile Analyzer rhtpa-trustification-service-rhel9
    affected: workaround, no fix available
  • Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1791452477
    fixed: vendor fix RHSA-2026:83548
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-381.el8cp, ceph 18.2.1-381.el9cp, cephadm 18.2.1-381.el9cp, librbd1 18.2.1-381.el8cp, librbd1 18.2.1-381.el9cp, librgw2 18.2.1-381.el8cp, +37 more
    fixed: vendor fix RHSA-2026:2769
  • Red Hat Ceph Storage 8 rhceph
    fixed: vendor fix RHSA-2025:21203
  • Red Hat Ceph Storage 8.1 rhceph/rhceph-8-rhel9 1787550654
    fixed: vendor fix RHSA-2026:62115
  • Red Hat Ceph Storage 8.1 Tools ceph 19.2.1-292.el9cp, cephadm 19.2.1-292.el9cp, librbd1 19.2.1-292.el9cp, librgw2 19.2.1-292.el9cp, rbd-nbd 19.2.1-292.el9cp, ceph-mib 19.2.1-292.el9cp, +17 more
    fixed: vendor fix RHSA-2025:21068
  • Red Hat Ceph Storage 9.0 rhceph 1776359884
    fixed: vendor fix RHSA-2026:8568
  • Red Hat Ceph Storage 9.0 Tools ceph 20.1.0-144.el9cp, ceph 20.1.0-144.el10cp, cephadm 20.1.0-144.el9cp, librbd1 20.1.0-144.el9cp, librgw2 20.1.0-144.el9cp, rbd-nbd 20.1.0-144.el9cp, +40 more
    fixed: vendor fix RHSA-2026:1536
  • Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts 8.0.112-1.el9_5
    fixed: vendor fix RHBA-2025:0304
  • Red Hat Enterprise Linux AppStream (v. 8) dotnet8.0 8.0.112-1.el8_10, dotnet-sdk-8.0 8.0.112-1.el8_10, dotnet-hostfxr-8.0 8.0.12-1.el8_10, dotnet-runtime-8.0 8.0.12-1.el8_10, dotnet-sdk-dbg-8.0 8.0.112-1.el8_10, dotnet-templates-8.0 8.0.112-1.el8_10, +6 more
    fixed: vendor fix RHSA-2025:0381
  • Red Hat Enterprise Linux AppStream (v. 9) dotnet8.0 8.0.112-1.el9_5, dotnet-sdk-8.0 8.0.112-1.el9_5, dotnet-hostfxr-8.0 8.0.12-1.el9_5, dotnet-runtime-8.0 8.0.12-1.el9_5, dotnet-sdk-dbg-8.0 8.0.112-1.el9_5, dotnet-templates-8.0 8.0.112-1.el9_5, +6 more
    fixed: vendor fix RHBA-2025:0304
  • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts 8.0.112-1.el8_10
    fixed: vendor fix RHSA-2025:0381
  • Red Hat OpenShift Pipelines 1.14.6 openshift-pipelines v1.14.6-1744143767
    fixed: vendor fix RHSA-2025:3870
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines v1.15.3-1746936251, openshift-pipelines v1.15.3-1746939886
    fixed: vendor fix RHSA-2025:8078

11 more fixed, 37 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm serialize-javascript
>=6.0.0, <6.0.2
6.0.2

Affected products

  • Red Hat Red Hat Advanced Cluster Security 4.4
  • Red Hat Red Hat Advanced Cluster Security 4.5
  • Red Hat Red Hat Ceph Storage 7.1
  • Red Hat Red Hat Ceph Storage 8.1
  • Red Hat Red Hat Ceph Storage 9.0
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat RHODF-4.14-RHEL-9
  • Red Hat RHODF-4.15-RHEL-9
  • Red Hat RHODF-4.16-RHEL-9
  • Red Hat RHODF-4.17-RHEL-9
  • Red Hat RHODF-4.18-RHEL-9
  • Red Hat Red Hat Ceph Storage 8
  • Red Hat Red Hat OpenShift Pipelines 1.14.6
  • Red Hat Red Hat OpenShift Pipelines 1.15
  • Red Hat Red Hat OpenShift Pipelines 1.16
  • Red Hat Red Hat OpenShift Pipelines 1.17
  • Red Hat Red Hat OpenShift Pipelines 1.18.0
  • Red Hat Red Hat OpenShift Pipelines 1.19
  • Red Hat Cryostat 3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat .NET 6.0 on Red Hat Enterprise Linux
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat OpenShift Service Mesh 2
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat Ceph Storage 7
  • Red Hat Red Hat Ceph Storage 9
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Developer Hub 1
  • Red Hat Red Hat Discovery 1
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 3.11
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat OpenShift distributed tracing 3

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.