serialize-javascript XSS via unsanitized regex input
CVE-2024-11831 Published on February 10, 2025

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-11831 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2024-11831 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2024-11831

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-11831 are published in these products:

Red Hat Advanced Cluster Security
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift Data Foundation
 
Red Hat Cryostat
 
Red Hat Logging
 
Red Hat Migration Toolkit Virtualization
 
Red Hat Rhel Dotnet
 
Red Hat Openshift Lightspeed
 
Red Hat Openshift Pipelines
 
Red Hat Serverless
 
Red Hat Service Mesh
 
Red Hat 3scale Amp
 
Red Hat Acm
 
Red Hat Ansible Automation Platform
 
Red Hat Apache Camel Hawtio
 
Red Hat Service Registry
 
Red Hat Optaplanner
 
Red Hat Ceph Storage
 
Red Hat Jboss Data Grid
 
Red Hat Rhdh
 
Red Hat Discovery
 
Red Hat Jboss Fuse
 
Red Hat Integration
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Openshift Ai
 
Red Hat Openshift
 
Red Hat Openshift Devspaces
 
Red Hat Openshift Distributed Tracing
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Quay
 
Red Hat Satellite
 
Red Hat Single Sign On
 
Red Hat Trusted Profile Analyzer
 
Red Hat Rhivos
 

Exploit Probability

EPSS
1.67%
Percentile
81.85%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.