CVE-2024-11831: Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-10 · updated 2026-11-01
Weakness: CWE-79

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Affected products

Red Hat 3scale API Management Platform 2: all versions
Red Hat Cryostat 3: all versions
Red Hat Logging Subsystem for Red Hat OpenShift: all versions
Red Hat OpenShift Lightspeed: all versions
Red Hat OpenShift Pipelines: all versions
Red Hat OpenShift Serverless: all versions
Red Hat OpenShift Service Mesh 2: all versions
Red Hat Quay 3: all versions
Red Hat Advanced Cluster Security 4.4: all versions — fixed in 4.4.8-2
Red Hat Advanced Cluster Security 4.5: all versions — fixed in 4.5.6-2
Red Hat Ansible Automation Platform 2: all versions
Red Hat build of Apicurio Registry 2: all versions
Red Hat build of OptaPlanner 8: all versions
Red Hat Ceph Storage 7: all versions
Red Hat Ceph Storage 7.1: all versions — fixed in 2:18.2.1-381.el8cp
Red Hat Ceph Storage 8: all versions — fixed in 8
Red Hat Ceph Storage 8.1: all versions — fixed in 2:19.2.1-292.el9cp
Red Hat Ceph Storage 9: all versions
Red Hat Ceph Storage 9.0: all versions — fixed in 2:20.1.0-144.el10cp
Red Hat Data Grid 8: all versions
Red Hat Discovery 1: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:8.0.112-1.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:8.0.112-1.el9_5
Red Hat Fuse 7: all versions
Red Hat OpenShift AI (RHOAI): all versions
Red Hat OpenShift Container Platform 3.11: all versions
Red Hat OpenShift Dev Spaces: all versions
Red Hat OpenShift distributed tracing 3: all versions
Red Hat OpenShift Pipelines 1.14.6: all versions — fixed in v1.14.6-1744143767
Red Hat OpenShift Pipelines 1.15: all versions — fixed in v1.15.3-1746939886

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Security 4.4 4.4.8-2; Red Hat Advanced Cluster Security 4.5 4.5.6-2; Red Hat Ceph Storage 7.1 2:18.2.1-381.el8cp; Red Hat Ceph Storage 8 8; Red Hat Ceph Storage 8.1 2:19.2.1-292.el9cp; Red Hat Ceph Storage 9.0 2:20.1.0-144.el10cp; Red Hat Enterprise Linux 8 0:8.0.112-1.el8_10; Red Hat Enterprise Linux 9 0:8.0.112-1.el9_5; Red Hat OpenShift Pipelines 1.14.6 v1.14.6-1744143767; Red Hat OpenShift Pipelines 1.15 v1.15.3-1746939886; Red Hat OpenShift Pipelines 1.16 v1.16.4-1747983385; Red Hat OpenShift Pipelines 1.17 v1.17.2-1749452800. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-11831 or the next vulnerability affects your stack