Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
Collected exploitation and prediction evidence
Risk source coverageCISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.
cve-program · CVE-2024-11831
PublishedA flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
- Source published
- 10 Feb 2025 15:27:46 UTC
- Source modified
- 5 Nov 2026 11:44:53 UTC
- Observed here
- 5 Nov 2026 12:36:20 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
euvd · EUVD-2025-4485
PublishedA flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Feb 10, 2025, 3:27:46 PM
dateUpdated: Nov 5, 2026, 11:44:53 AM
24 related source bulletins · separate from aliases
RHSA-2025:8233: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.1
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-48949
RHSA-2026:62115: Red Hat Security Advisory: Red Hat Ceph Storage
CVE-2019-10790 · CVE-2023-25153 · CVE-2023-28155 · CVE-2024-11831 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-59436 · CVE-2025-66418 · CVE-2026-24049
RHSA-2025:9294: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.17.2
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-48949
RHSA-2025:8551: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-29041 · CVE-2024-29180 · CVE-2024-37890 · CVE-2024-39249 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910
msrc_CVE-2024-11831: Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
CVE-2024-11831
RHSA-2026:8568: Red Hat Security Advisory: New container image: rhceph-9.0
CVE-2024-11831 · CVE-2025-59436
RHSA-2026:83548: Red Hat Security Advisory: Red Hat Ceph Storage
CVE-2019-10790 · CVE-2023-25153 · CVE-2023-28155 · CVE-2023-46159 · CVE-2024-5206 · CVE-2024-11831 · CVE-2024-37890 · CVE-2024-47866 · CVE-2025-7783 · CVE-2025-30156 · CVE-2025-47914 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58181 · CVE-2025-59436 · CVE-2025-64718 · CVE-2025-64756 · CVE-2026-50152
RHSA-2025:21068: Red Hat Security Advisory: Red Hat Ceph Storage 8.1 bug fix update
CVE-2024-11831 · CVE-2024-47866
RHSA-2025:8512: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.16.4
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-48949
WID-SEC-W-2025-2584: Red Hat Enterprise Linux Ceph Storage: Mehrere Schwachstellen
CVE-2024-11831 · CVE-2024-47866
RHBA-2025:0304: Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update
CVE-2024-11831 · CVE-2025-21172 · CVE-2025-21173 · CVE-2025-21176
RHSA-2025:1468: Red Hat Security Advisory: ACS 4.4 enhancement and security update
CVE-2024-11831 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-21613 · CVE-2025-21614
RHSA-2025:10853: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.19.0
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-48949
RHSA-2025:8059: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-29041 · CVE-2024-39249 · CVE-2024-45338 · CVE-2024-45590 · CVE-2025-27144 · CVE-2025-30204
RHSA-2026:2769: Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates
CVE-2021-23358 · CVE-2022-34749 · CVE-2024-11831 · CVE-2024-31884 · CVE-2024-47866 · CVE-2024-51744 · CVE-2024-55565 · CVE-2025-26791 · CVE-2025-47913 · CVE-2025-52555 · CVE-2025-61729
RHSA-2025:8544: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-29041 · CVE-2024-29180 · CVE-2024-37890 · CVE-2024-39249 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910 · CVE-2025-22868 · CVE-2025-30204
RHSA-2026:1536: Red Hat Security Advisory: Red Hat Ceph Storage 9.0 Security and Enhancement update
CVE-2023-25153 · CVE-2024-11831 · CVE-2024-31884 · CVE-2025-30204 · CVE-2025-52555
RHSA-2025:3870: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.14.6
CVE-2024-11831
RHSA-2025:1334: Red Hat Security Advisory: ACS 4.5 enhancement and security update
CVE-2024-11831 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-21613 · CVE-2025-21614
RHSA-2025:4511: Red Hat Security Advisory: RHODF-4.18-RHEL-9 security update
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-29041 · CVE-2025-22868 · CVE-2025-22869 · CVE-2025-27144 · CVE-2025-30204
RHSA-2025:0381: Red Hat Security Advisory: .NET 8.0 security update
CVE-2024-11831 · CVE-2025-21172 · CVE-2025-21173 · CVE-2025-21176
RHSA-2025:21203: Red Hat Security Advisory: Red Hat Ceph Storage
CVE-2024-11831 · CVE-2024-47866
RHSA-2025:8078: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3
CVE-2024-11831 · CVE-2024-48949
RHSA-2025:8479: Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update
CVE-2024-11831 · CVE-2024-21536 · CVE-2024-29041 · CVE-2024-39249 · CVE-2024-45338 · CVE-2024-45590 · CVE-2025-30204
- Source published
- Feb 10, 2025, 3:27:46 PM (timezone not stated)
- Source modified
- Nov 5, 2026, 11:44:53 AM (timezone not stated)
- Observed here
- 8 Nov 2026 23:10:20 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.
EUVD CVSS 3.1 · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd · CVE-2024-11831
PublishedA flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-79
Original publisher date fields
published: 2025-02-10T16:15:37.080
lastModified: 2026-11-05T12:17:44.500
- Source published
- 10 Feb 2025 16:15:37 UTC
- Source modified
- 5 Nov 2026 12:17:44 UTC
- Observed here
- 6 Nov 2026 03:36:32 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS 3.1 · [email protected] · Secondary · 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv · GHSA-76p7-773f-r4q5
PublishedA flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
- Source published
- 10 Feb 2025 18:30:47 UTC
- Source modified
- 15 Oct 2026 21:45:05 UTC
- Observed here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Publisher rating · MODERATE