VYPR
← All advisories
Medium severity5.4OSV Advisory· Published Feb 10, 2025· Updated Jul 1, 2026

CVE-2024-11831

CVE-2024-11831

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
serialize-javascriptnpm
>= 6.0.0, < 6.0.26.0.2

Affected products

48

Patches

Vulnerability mechanics

References

27

News mentions

0

No linked articles in our index yet.