CVE-2024-11831: npm-serialize-javascript XSS Vulnerability

CVE-2024-11831 Overview

CVE-2024-11831 affects the serialize-javascript npm package maintained by Yahoo. The flaw stems from improper sanitization of certain input types, including regular expressions and other JavaScript object types. Attackers can inject malicious code that executes when a web browser deserializes the output. This behavior produces Cross-Site Scripting (XSS) conditions in applications that forward serialized data to web clients. The weakness is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Attackers who control serialized input can trigger XSS in downstream browsers, compromising session integrity and confidentiality for applications relying on serialize-javascript.

Affected Products

• serialize-javascript npm package (Yahoo)
• Red Hat products bundling vulnerable serialize-javascript versions (see Red Hat errata referenced below)
• Node.js and browser applications that embed serialized data produced by the library

Discovery Timeline

• 2025-02-10 - CVE-2024-11831 published to the National Vulnerability Database (NVD)
• 2026-10-27 - Last updated in NVD database

Technical Details for CVE-2024-11831

Vulnerability Analysis

The serialize-javascript module converts JavaScript values, including functions, regular expressions, and URL objects, into a string that can be safely transported or embedded. When the serializer encountered URL objects, it embedded the raw URL string into the output without encoding its contents. An attacker who influenced the URL value could inject characters that break out of the string literal when the serialized payload is later evaluated or rendered in a browser. The resulting output executes attacker-controlled script in the context of the hosting page.

Root Cause

The root cause is unsafe string concatenation when serializing URL objects. The library wrapped the URL in new URL("...") using raw string interpolation. Any quote, backslash, or script-closing sequence inside the URL value broke out of the literal and was emitted verbatim into the serialized JavaScript.

Attack Vector

Exploitation requires an attacker to supply crafted input that reaches a serialize-javascript call, such as a user-controlled URL stored by the server and later serialized into a page. When the page loads, the browser parses the malformed serialized script and executes the injected payload. User interaction is required because the payload fires during rendering of attacker-influenced content.

// Patch excerpt from index.js — Yahoo serialize-javascript
        }

        if (type === 'L') {
-            return "new URL(\"" + urls[valueIndex].toString() + "\")"; 
+            return "new URL(" + serialize(urls[valueIndex].toString(), options) + ")";
        }

        var fn = functions[valueIndex];

Source: GitHub Commit f27d65d. The fix routes the URL string through the library's own serialize() function, which escapes characters that would otherwise terminate the string literal.

Detection Methods for CVE-2024-11831

Indicators of Compromise

• Serialized JavaScript responses containing unexpected quote characters, </script> sequences, or backslash patterns inside new URL("...") constructs.
• Unexpected <script> execution originating from pages that embed server-rendered serialized state.
• Browser Content Security Policy (CSP) violation reports referencing inline script execution on pages that use the library.

Detection Strategies

• Perform a software composition analysis (SCA) scan of package-lock.json and yarn.lock for serialize-javascript versions prior to the patched release.
• Inspect server responses that embed serialized state for payloads where URL fields contain quote or angle-bracket characters.
• Monitor web application firewall (WAF) logs for user-supplied URL parameters containing ", \, or </script> sequences destined for routes known to serialize state.

Monitoring Recommendations

• Enable CSP reporting to surface unexpected inline script execution on affected applications.
• Log and alert on dependency version drift when serialize-javascript is pinned in build manifests.
• Correlate browser-side error telemetry with server-side serialization paths to identify injection attempts.

How to Mitigate CVE-2024-11831

Immediate Actions Required

• Upgrade serialize-javascript to the patched release that includes commit f27d65d3de42affe2aac14607066c293891cec4e.
• Rebuild and redeploy any application artifact that bundles the vulnerable library, including container images and offline packages.
• For Red Hat environments, apply the vendor errata referenced for this CVE, including RHSA-2025:0381, RHSA-2025:1334, and later advisories listed in the Red Hat CVE Report.

Patch Information

The upstream fix is tracked in Pull Request #173 and merged as commit f27d65d. The change routes URL string contents through the library's own escaping path, preventing attacker-controlled characters from breaking out of the serialized literal. Red Hat has shipped the fix across multiple components, as documented in advisories such as RHSA-2025:1468 and RHSA-2025:3870.

Workarounds

• Validate and normalize user-supplied URLs server-side before passing them to serialize-javascript, rejecting inputs that contain quotes, backslashes, or angle brackets.
• Enforce a strict Content Security Policy that disallows inline scripts and uses nonces or hashes for permitted scripts.
• Avoid serializing untrusted URL objects into pages until the patched library version is deployed.

# Verify and upgrade the vulnerable dependency
npm ls serialize-javascript
npm install serialize-javascript@latest
npm audit fix