CVE-2024-11831

Published Feb 10, 2025

Last updated 3 hours ago

CVSS medium 5.4
XSS

Overview

Description
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Source
secalert@redhat.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.4
Impact score
2.7
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity
MEDIUM

Weaknesses

secalert@redhat.com
CWE-79

Social media

Hype score
Not currently trending

  1. 🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2024-11831](https://t.co/OBENd4OKdR) A flaw was found in npm-seriali... https://t.co/OBENd4OKdR #Vulnerability #CVE #ZeroDay

    @MalwareObserver

    2 Aug 2026

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2024-11831](https://t.co/OBENd4OKdR) A flaw was found in npm-seriali... https://t.co/OBENd4OKdR #Vulnerability #CVE #ZeroDay

    @MalwareObserver

    26 Jul 2026

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 CVE-2024-11831 🟠 MEDIUM (5.4) 🏢 Red Hat - Cryostat 3 🏗️ None 🔗 https://t.co/RwQEw9bFDJ 🔗 https://t.co/vLzAVn3PGD 🔗 https://t.co/3m2QoBZEL6 🔗 https://t.co/Oljt2JKDH9 #CyberCron #VulnAlert https://t.co/mNHwBAvr7W

    @cybercronai

    10 Feb 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2024-11831 A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as rege… https://t.co/8i1BhUkBvJ

    @CVEnew

    10 Feb 2025

    261 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. New post from https://t.co/uXvPWJy6tj (CVE-2024-11831 | npm-serialize-javascript up to 6.0.1 cross site scripting) has been published on https://t.co/qBYaXeA186

    @WolfgangSesin

    10 Feb 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.•CVE-2026-84695
  2. WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.•CVE-2026-84479
  3. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.•CVE-2026-74234
  4. WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).•CVE-2026-64638
  5. Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.•CVE-2026-65439

References

Sources include official advisories and independent security research.