CVE-2024-11831 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
Attackers can inject malicious scripts via unsanitized inputs in serialize-javascript, leading to XSS when data is deserialized by web browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-11831?
CVE-2024-11831 is a medium-severity cross-site scripting vulnerability in .NET 6.0 on Red Hat Enterprise Linux, published on 10 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Weakness: CWE-79
Which versions are affected by CVE-2024-11831?
2 open source packages ship an affected version, including serialize-javascript.
| Package | Affected | Fixed in |
|---|---|---|
serialize-javascript npm | From 6.0.0 | 6.0.2 |
serialize-javascript npm | From 6.0.0 | 6.0.2 |
How do I fix CVE-2024-11831?
Upgrade serialize-javascript to 6.0.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-11831 being exploited?
There is no known exploitation of CVE-2024-11831 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-11831, GHSA-76p7-773f-r4q5, MINI-cwg8-87xw-62h9, UBUNTU-CVE-2024-11831.