{"id":"EUVD-2025-4485","revision":"04de6988f57e4139beda1d9103485a3c","records":[{"revision":"04de6988f57e4139beda1d9103485a3c","observedAt":"2026-11-04T22:04:02.027+00:00","statement":{"source":"euvd","id":"EUVD-2025-4485","aliases":["CVE-2024-11831","GHSA-76p7-773f-r4q5"],"title":"A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicio…","description":"A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://access.redhat.com/errata/RHBA-2025:0304","https://access.redhat.com/errata/RHSA-2025:0381","https://access.redhat.com/errata/RHSA-2025:10853","https://access.redhat.com/errata/RHSA-2025:1334","https://access.redhat.com/errata/RHSA-2025:1468","https://access.redhat.com/errata/RHSA-2025:21068","https://access.redhat.com/errata/RHSA-2025:21203","https://access.redhat.com/errata/RHSA-2025:3870","https://access.redhat.com/errata/RHSA-2025:4511","https://access.redhat.com/errata/RHSA-2025:8059","https://access.redhat.com/errata/RHSA-2025:8078","https://access.redhat.com/errata/RHSA-2025:8233","https://access.redhat.com/errata/RHSA-2025:8479","https://access.redhat.com/errata/RHSA-2025:8512","https://access.redhat.com/errata/RHSA-2025:8544","https://access.redhat.com/errata/RHSA-2025:8551","https://access.redhat.com/errata/RHSA-2025:9294","https://access.redhat.com/errata/RHSA-2026:1536","https://access.redhat.com/errata/RHSA-2026:2769","https://access.redhat.com/errata/RHSA-2026:62115","https://access.redhat.com/errata/RHSA-2026:83548","https://access.redhat.com/errata/RHSA-2026:8568","https://access.redhat.com/security/cve/CVE-2024-11831","https://bugzilla.redhat.com/show_bug.cgi?id=2312579","https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e","https://github.com/yahoo/serialize-javascript/pull/173"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-4485","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 10, 2025, 3:27:46 PM","dateUpdated":"Nov 1, 2026, 5:20:01 AM"},"relatedAdvisories":[{"id":"RHSA-2025:8233","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.1","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-48949"]},{"id":"RHSA-2026:62115","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2019-10790","CVE-2023-25153","CVE-2023-28155","CVE-2024-11831","CVE-2025-50181","CVE-2025-50182","CVE-2025-59436","CVE-2025-66418","CVE-2026-24049"]},{"id":"RHSA-2025:9294","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.17.2","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-48949"]},{"id":"RHSA-2025:8551","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-21538","CVE-2024-29041","CVE-2024-29180","CVE-2024-37890","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2024-48910"]},{"id":"msrc_CVE-2024-11831","title":"Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript","vulnerabilityIds":["CVE-2024-11831"]},{"id":"RHSA-2026:8568","title":"Red Hat Security Advisory: New container image: rhceph-9.0","vulnerabilityIds":["CVE-2024-11831","CVE-2025-59436"]},{"id":"RHSA-2026:83548","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2019-10790","CVE-2023-25153","CVE-2023-28155","CVE-2023-46159","CVE-2024-5206","CVE-2024-11831","CVE-2024-37890","CVE-2024-47866","CVE-2025-7783","CVE-2025-30156","CVE-2025-47914","CVE-2025-50181","CVE-2025-50182","CVE-2025-58181","CVE-2025-59436","CVE-2025-64718","CVE-2025-64756","CVE-2026-50152"]},{"id":"RHSA-2025:21068","title":"Red Hat Security Advisory: Red Hat Ceph Storage 8.1 bug fix update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-47866"]},{"id":"RHSA-2025:8512","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.16.4","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-48949"]},{"id":"WID-SEC-W-2025-2584","title":"Red Hat Enterprise Linux Ceph Storage: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2024-11831","CVE-2024-47866"]},{"id":"RHBA-2025:0304","title":"Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update","vulnerabilityIds":["CVE-2024-11831","CVE-2025-21172","CVE-2025-21173","CVE-2025-21176"]},{"id":"RHSA-2025:1468","title":"Red Hat Security Advisory: ACS 4.4 enhancement and security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"RHSA-2025:10853","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.0","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-48949"]},{"id":"RHSA-2025:8059","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2026:2769","title":"Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates","vulnerabilityIds":["CVE-2021-23358","CVE-2022-34749","CVE-2024-11831","CVE-2024-31884","CVE-2024-47866","CVE-2024-51744","CVE-2024-55565","CVE-2025-26791","CVE-2025-47913","CVE-2025-52555","CVE-2025-61729"]},{"id":"RHSA-2025:8544","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-21538","CVE-2024-29041","CVE-2024-29180","CVE-2024-37890","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2024-48910","CVE-2025-22868","CVE-2025-30204"]},{"id":"RHSA-2026:1536","title":"Red Hat Security Advisory: Red Hat Ceph Storage 9.0 Security and Enhancement update","vulnerabilityIds":["CVE-2023-25153","CVE-2024-11831","CVE-2024-31884","CVE-2025-30204","CVE-2025-52555"]},{"id":"RHSA-2025:3870","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.14.6","vulnerabilityIds":["CVE-2024-11831"]},{"id":"RHSA-2025:1334","title":"Red Hat Security Advisory: ACS 4.5 enhancement and security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"RHSA-2025:4511","title":"Red Hat Security Advisory: RHODF-4.18-RHEL-9 security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2025:0381","title":"Red Hat Security Advisory: .NET 8.0 security update","vulnerabilityIds":["CVE-2024-11831","CVE-2025-21172","CVE-2025-21173","CVE-2025-21176"]},{"id":"RHSA-2025:21203","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2024-11831","CVE-2024-47866"]},{"id":"RHSA-2025:8078","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3","vulnerabilityIds":["CVE-2024-11831","CVE-2024-48949"]},{"id":"RHSA-2025:8479","title":"Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-21536","CVE-2024-29041","CVE-2024-39249","CVE-2024-45338","CVE-2024-45590","CVE-2025-30204"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-4485","identifiers":["EUVD-2025-4485","CVE-2024-11831","GHSA-76p7-773f-r4q5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}