CVE-2024-11831: Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Other sources
The serialize-javascript module is vulnerable to Cross-Site Scripting (XSS) due to insufficient sanitization of serialized JavaScript objects, specifically affecting versions before 6.0.2. Attackers can inject malicious scripts that could execute in the context of the user's browser, leading to unauthorized actions or data exposure.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/serialize-javascriptto a version that resolves this vulnerability.Fixed in 6.0.2 - Upgrade
Upgrade
npm-serialize-javascriptto a version that resolves this vulnerability.Fixed in 6.0.2 - Compensating control
If serialized data is sent to web clients, ensure the data/outputs produced using serialize-javascript are not used in a way that will execute injected code in the browser (e.g., avoid inserting the serialized output into executable script contexts on the client) until the package is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11831?
CVE-2024-11831 is classified as a high severity vulnerability due to its potential for code injection.
How do I fix CVE-2024-11831?
To mitigate CVE-2024-11831, update the serialize-javascript package to version 6.0.2 or later.
What types of inputs are problematic in CVE-2024-11831?
CVE-2024-11831 is caused by improper sanitization of certain inputs, specifically regex and JavaScript object types.
What can an attacker do with CVE-2024-11831?
An attacker can exploit CVE-2024-11831 to inject and execute malicious code within the application.
Which versions of serialize-javascript are affected by CVE-2024-11831?
CVE-2024-11831 affects all versions of serialize-javascript up to but not including version 6.0.2.