GitHub Advisoryadvisory · npm

GHSA-76p7-773f-r4q5 Cross-site Scripting (XSS) in serialize-javascript

MEDIUM Published 2025-02-10 Modified 2026-10-15 Official page ↗
Aliases
CVE-2024-11831
Ecosystem
npm
Packages
serialize-javascript
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-02-10

Affected packages

• npm serialize-javascript: >= 6.0.0, < 6.0.2 → fixed in 6.0.2

Description

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Related

Alias · CVE (1)

  • CVE-2024-11831 A flaw was found in npm-serialize-javascript. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References