CVE-2024-11831 | Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Published: 2025-02-10 Last update: 2026-06-25 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2024-11831 is rated Moderate Risk (41.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.98%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-11831

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.13% 0.98% -0.15%
2 2026-05-25 0.94% 1.13% +0.19%
3 2026-05-22 0.94%

Full EPSS history (26 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-11831

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.4 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
2.3 2.7 [email protected]

Weakness enumeration for CVE-2024-11831

GitHub Security Advisory for CVE-2024-11831

GHSA-76p7-773f-r4q5 · Severity: medium · Ecosystem: npm — Cross-site Scripting (XSS) in serialize-javascript

OS Trackers for CVE-2024-11831

vendor priority summary link
debian unimportant CVE-2024-11831 unimportant priority: Debian including 1 source packages (node-serialize-javascript), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2024-11831
redhat medium https://access.redhat.com/security/cve/CVE-2024-11831
suse medium CVE-2024-11831 severity moderate: SUSE including 82 source package names (aspnetcore-runtime-8.0-8.0.12-1.el8_10, aspnetcore-runtime-8.0-8.0.12-1.el9_5, …), 339 product×package rows across 35 product lines (SLES-LTSS-TERADATA 15 SP2, SUSE Liberty Linux 8, … (35 product lines)): Known Not Affected 315, Fixed 24. https://www.suse.com/security/cve/CVE-2024-11831/
ubuntu medium CVE-2024-11831 medium priority: Ubuntu including 1 source packages (node-serialize-javascript), 7 status rows across 7 suites (focal, jammy, noble, oracular, plucky, questing, upstream): needs-triage 4, ignored 2, DNE 1. https://ubuntu.com/security/CVE-2024-11831

Affected software / configurations for CVE-2024-11831

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2024-11831

URL Tags
https://access.redhat.com/errata/RHBA-2025:0304
https://access.redhat.com/errata/RHSA-2025:0381
https://access.redhat.com/errata/RHSA-2025:10853
https://access.redhat.com/errata/RHSA-2025:1334
https://access.redhat.com/errata/RHSA-2025:1468
https://access.redhat.com/errata/RHSA-2025:21068
https://access.redhat.com/errata/RHSA-2025:21203
https://access.redhat.com/errata/RHSA-2025:3870
https://access.redhat.com/errata/RHSA-2025:4511
https://access.redhat.com/errata/RHSA-2025:8059
https://access.redhat.com/errata/RHSA-2025:8078
https://access.redhat.com/errata/RHSA-2025:8233
https://access.redhat.com/errata/RHSA-2025:8479
https://access.redhat.com/errata/RHSA-2025:8512
https://access.redhat.com/errata/RHSA-2025:8544
https://access.redhat.com/errata/RHSA-2025:8551
https://access.redhat.com/errata/RHSA-2025:9294
https://access.redhat.com/errata/RHSA-2026:1536
https://access.redhat.com/errata/RHSA-2026:2769
https://access.redhat.com/errata/RHSA-2026:8568
https://access.redhat.com/security/cve/CVE-2024-11831
https://bugzilla.redhat.com/show_bug.cgi?id=2312579
https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e
https://github.com/yahoo/serialize-javascript/pull/173
cvelogic Threat Intelligence