CVE-2024-11831

node-serialize-javascript: A flaw was found in npm-serialize-javascript

CVE-2024-11831 is fixed in 13 products on 1 platform, first by RHBA-2025:0304, released January 14, 2025. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.4
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0112
66th percentile

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Where it's fixed

ProductFixed inFixReleased
Linux
aspnetcore-runtime-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
aspnetcore-runtime-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
aspnetcore-runtime-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
aspnetcore-runtime-dbg-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
aspnetcore-runtime-dbg-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
aspnetcore-runtime-dbg-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
aspnetcore-targeting-pack-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
aspnetcore-targeting-pack-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
aspnetcore-targeting-pack-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-apphost-pack-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-apphost-pack-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-apphost-pack-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-hostfxr-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-hostfxr-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-hostfxr-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-runtime-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-runtime-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-runtime-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-runtime-dbg-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-runtime-dbg-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-runtime-dbg-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-sdk-8.0 · RHEL 8 0:8.0.112-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-sdk-8.0 · RHEL 9 0:8.0.112-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-sdk-8.0 · almalinux 8 8.0.112-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-sdk-8.0-source-built-artifacts · RHEL 8 0:8.0.112-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-sdk-8.0-source-built-artifacts · RHEL 9 0:8.0.112-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-sdk-8.0-source-built-artifacts · almalinux 8 8.0.112-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-sdk-dbg-8.0 · RHEL 8 0:8.0.112-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-sdk-dbg-8.0 · RHEL 9 0:8.0.112-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-sdk-dbg-8.0 · almalinux 8 8.0.112-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-targeting-pack-8.0 · RHEL 8 0:8.0.12-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-targeting-pack-8.0 · RHEL 9 0:8.0.12-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-targeting-pack-8.0 · almalinux 8 8.0.12-1.el8_10 ALSA-2025:0381 Jan 16, 2025
dotnet-templates-8.0 · RHEL 8 0:8.0.112-1.el8_10 RHSA-2025:0381 Jan 16, 2025
dotnet-templates-8.0 · RHEL 9 0:8.0.112-1.el9_5 RHBA-2025:0304 Jan 14, 2025
dotnet-templates-8.0 · almalinux 8 8.0.112-1.el8_10 ALSA-2025:0381 Jan 16, 2025
node-serialize-javascript · Debian 12.15 (bookworm) 6.0.0-2+deb12u1 DEBIAN-CVE-2024-11831 Feb 10, 2025
node-serialize-javascript · Debian 13.5 (trixie) 6.0.2-1 DEBIAN-CVE-2024-11831 Feb 10, 2025
node-serialize-javascript · Debian 14 6.0.2-1 DEBIAN-CVE-2024-11831 Feb 10, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.