Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

Summary

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Timeline

1. Feb 10, 2025, 3:27 PM UTCCVE published
2. Feb 10, 2025, 5:08 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 30, 2026, 6:28 PM UTCRecord last updated

Affected versions

• serialize-javascript

  From 6.0 · fixed in 6.0.2

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-main-rhel8

  Version range not reported

• ceph

  Version range not reported

• ceph

  Version range not reported

• ceph

  Version range not reported

• dotnet8.0

  Version range not reported

• dotnet8.0

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• odf4/ocs-client-console-rhel9

  Version range not reported

• odf4/odf-console-rhel9

  Version range not reported

• odf4/odf-multicluster-console-rhel9

  Version range not reported

• rhceph/rhceph-7-rhel9

  Version range not reported

• rhceph/rhceph-8-rhel9

  Version range not reported

• rhceph/rhceph-8-rhel9

  Version range not reported

• rhceph/rhceph-9-rhel9

  Version range not reported

• openshift-pipelines/pipelines-hub-ui-rhel8

  Version range not reported

• openshift-pipelines/pipelines-console-plugin-rhel8

  Version range not reported

• openshift-pipelines/pipelines-hub-ui-rhel8

  Version range not reported

• openshift-pipelines/pipelines-console-plugin-rhel8

  Version range not reported

• openshift-pipelines/pipelines-hub-ui-rhel8

  Version range not reported

• openshift-pipelines/pipelines-console-plugin-rhel8

  Version range not reported

• openshift-pipelines/pipelines-hub-ui-rhel8

  Version range not reported

• openshift-pipelines/pipelines-console-plugin-rhel9

  Version range not reported

• openshift-pipelines/pipelines-console-plugin-rhel9

  Version range not reported

• serialize-javascript

  Version range not reported

• openshift-logging/kibana6-rhel8

  Version range not reported

• migration-toolkit-virtualization/mtv-console-plugin-rhel9

  Version range not reported

• rh-dotnet60-dotnet

  Version range not reported

• openshift-lightspeed-beta/lightspeed-console-plugin-rhel9

  Version range not reported

• openshift-pipelines/pipelines-hub-api-rhel8

  Version range not reported

• openshift-pipelines/pipelines-hub-db-migration-rhel8

  Version range not reported

• serialize-javascript

  Version range not reported

• openshift-service-mesh/kiali-ossmc-rhel8

  Version range not reported

• openshift-service-mesh/kiali-rhel8

  Version range not reported

• 3scale-amp-system-container

  Version range not reported

• rhacm2/console-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-central-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-rhel8-operator

  Version range not reported

• advanced-cluster-security/rhacs-roxctl-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-v4-db-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-v4-rhel8

  Version range not reported

• aap-cloud-ui-container

  Version range not reported

• ansible-automation-platform-25/lightspeed-rhel8

  Version range not reported

• automation-controller

  Version range not reported

• automation-eda-controller

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• grafana

  Version range not reported

• libarrow

  Version range not reported

• pybind

  Version range not reported

• grafana

  Version range not reported

• libarrow

  Version range not reported

• pybind

  Version range not reported

• grafana

  Version range not reported

• libarrow

  Version range not reported

• pybind

  Version range not reported

• serialize-javascript

  Version range not reported

• rhdh/rhdh-hub-rhel9

  Version range not reported

• discovery-server-container

  Version range not reported

• dotnet8.0

  Version range not reported

• dotnet6.0

  Version range not reported

• grafana

  Version range not reported

• pcs

  Version range not reported

• dotnet6.0

  Version range not reported

• dotnet7.0

  Version range not reported

• pcs

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• serialize-javascript

  Version range not reported

• odh-dashboard-rhel8

  Version range not reported

• odh-data-science-pipelines-argo-argoexec-rhel8

  Version range not reported

• odh-data-science-pipelines-argo-workflowcontroller-rhel8

  Version range not reported

• odh-kf-notebook-controller-rhel8

  Version range not reported

• odh-ml-pipelines-api-server-v2-rhel8

  Version range not reported

• odh-ml-pipelines-driver-rhel8

  Version range not reported

• odh-ml-pipelines-launcher-rhel8

  Version range not reported

• odh-ml-pipelines-persistenceagent-v2-rhel8

  Version range not reported

• odh-ml-pipelines-scheduledworkflow-v2-rhel8

  Version range not reported

• odh-model-registry-rhel8

  Version range not reported

• odh-notebook-controller-rhel8

  Version range not reported

• rhoai/odh-dashboard-rhel8

  Version range not reported

• rhoai/odh-rhel8-operator

  Version range not reported

• openshift3/ose-console

  Version range not reported

• openshift4/ose-monitoring-plugin-rhel8

  Version range not reported

• devspaces/code-rhel8

  Version range not reported

• devspaces/dashboard-rhel8

  Version range not reported

• devspaces/traefik-rhel8

  Version range not reported

• rhosdt/jaeger-agent-rhel8

  Version range not reported

• rhosdt/jaeger-all-in-one-rhel8

  Version range not reported

• rhosdt/jaeger-collector-rhel8

  Version range not reported

• rhosdt/jaeger-es-index-cleaner-rhel8

  Version range not reported

• rhosdt/jaeger-es-rollover-rhel8

  Version range not reported

• rhosdt/jaeger-ingester-rhel8

  Version range not reported

• rhosdt/jaeger-query-rhel8

  Version range not reported

• serialize-javascript

  Version range not reported

• quay/quay-rhel8

  Version range not reported

• nodejs-compression-webpack-plugin

  Version range not reported

• nodejs-webpack

  Version range not reported

• serialize-javascript

  Version range not reported

• rhtpa/rhtpa-trustification-service-rhel9

  Version range not reported

• serialize-javascriptnpm

  From 6.0.0 · fixed in 6.0.2

References 25