PatchTheCVECVE-2024-11831: A flaw was found in npm-serialize-javascript
35
Routine
MEDIUM 5.4
CVE-2024-11831 is a medium-severity flaw (CVSS 5.4) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentia
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.1% (top 34%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-02-10 |
| Last modified | 2026-10-22 |
Publisher (CNA): Red Hat, Inc.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
npm · serialize-javascript · FIXED · 6.0.2 · vulnerable: >= 6.0.0, < 6.0.2 · source
npm install serialize-javascript@">=6.0.2"
npm ls serialize-javascript
Fedora 46 · wasmedge · FIXED · 0.18.1-1.fc46 · FEDORA-2026-4c27216e39 · source
sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39
Debian 12 · node-serialize-javascript · FIXED · 6.0.0-2+deb12u1
sudo apt update && sudo apt install --only-upgrade node-serialize-javascript
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' node-serialize-javascript)" ge "6.0.0-2+deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · node-serialize-javascript · FIXED · 6.0.2-1
sudo apt update && sudo apt install --only-upgrade node-serialize-javascript
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' node-serialize-javascript)" ge "6.0.2-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 8 · dotnet8.0 · FIXED · dotnet8.0-8.0.112-1.el8_10
sudo dnf upgrade --advisory=RHSA-2025:0381
rpm -q dotnet8.0
RHEL 9 · dotnet8.0 · FIXED · dotnet8.0-8.0.112-1.el9_5
sudo dnf upgrade --advisory=RHBA-2025:0304
rpm -q dotnet8.0
RHEL 10 · dotnet8.0 · NOT AFFECTED
RHEL 8 · dotnet6.0 · DEFERRED
RHEL 8 · grafana · DEFERRED
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.