VDB
RHSA-2025%3A1334
RHSA-2025%3A1334
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:9abbd37870679b1ece3da858f3bc9f107a43203ff43a4aafcb088d3e3803e678_s390x as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-scanner-v4-db-rhel8@sha256:9abbd37870679b1ece3da858f3bc9f107a43203ff43a4aafcb088d3e3803e678_s390x, * |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9fa462358a39923f6306b016314cbe923dffa46e27b2b53a5a77934f416c840d_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9fa462358a39923f6306b016314cbe923dffa46e27b2b53a5a77934f416c840d_s390x, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9fa462358a39923f6306b016314cbe923dffa46e27b2b53a5a77934f416c840d_s390x |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9fa462358a39923f6306b016314cbe923dffa46e27b2b53a5a77934f416c840d_s390x as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-roxctl-rhel8@sha256:9fa462358a39923f6306b016314cbe923dffa46e27b2b53a5a77934f416c840d_s390x, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:86e6f9339c16c873473c304220e2628593fe85c68ee9d8f7e68bda3db8106a9d_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:86e6f9339c16c873473c304220e2628593fe85c68ee9d8f7e68bda3db8106a9d_amd64 as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:86e6f9339c16c873473c304220e2628593fe85c68ee9d8f7e68bda3db8106a9d_amd64, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cb822f22db66571f9cbff1e0f26cb317946f43191da21e2723d8d56663278d80_ppc64le as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:cb822f22db66571f9cbff1e0f26cb317946f43191da21e2723d8d56663278d80_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:c153ef8bc0473cb3f5f6498c14609c8bddfc5c0fed33442144c79f5d42be190e_amd64 as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:c153ef8bc0473cb3f5f6498c14609c8bddfc5c0fed33442144c79f5d42be190e_amd64, advanced-cluster-security/rhacs-scanner-v4-rhel8@sha256:c153ef8bc0473cb3f5f6498c14609c8bddfc5c0fed33442144c79f5d42be190e_amd64 |
| Red Hat | advanced-cluster-security/rhacs-collector-rhel8@sha256:4eb90f3bb36a84d01e963bddb088c1f29777ba14e3317c4007b2d373c24bc6b5_ppc64le as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-collector-rhel8@sha256:4eb90f3bb36a84d01e963bddb088c1f29777ba14e3317c4007b2d373c24bc6b5_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:f4f22880b6ea0e5b97dd19c311ec00bf650e670373e14aaa29690481503e2fda_amd64 as a component of RHACS 4.5 for RHEL 8 | *, * |
| Red Hat | advanced-cluster-security/rhacs-central-db-rhel8@sha256:3e77d381ec1ef080140b8f4d71e3dd078096abd9409a8dfc9ea2b8f38cc66d2b_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7a5735d8ea892ad522179d10d6c4701798baf1bdbc6ed4b4f555ef2a30738670_s390x as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-central-db-rhel8@sha256:0ae5e45fe68d907fdfc1fdc9d4b040074acb8bc36cf979fe192451d48787707b_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-central-db-rhel8@sha256:0ae5e45fe68d907fdfc1fdc9d4b040074acb8bc36cf979fe192451d48787707b_s390x, advanced-cluster-security/rhacs-central-db-rhel8@sha256:0ae5e45fe68d907fdfc1fdc9d4b040074acb8bc36cf979fe192451d48787707b_s390x |
| Red Hat | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:f667a0644465523f295d7feae6f2e264e127e0e98cadd192519b8be9c4974b37_ppc64le as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:f667a0644465523f295d7feae6f2e264e127e0e98cadd192519b8be9c4974b37_ppc64le, advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:f667a0644465523f295d7feae6f2e264e127e0e98cadd192519b8be9c4974b37_ppc64le |
| Red Hat | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:68b336dc6aad04c2003762b310df258750d125e7e3d09743fbb3fb9570d885e7_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:68b336dc6aad04c2003762b310df258750d125e7e3d09743fbb3fb9570d885e7_s390x, advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:68b336dc6aad04c2003762b310df258750d125e7e3d09743fbb3fb9570d885e7_s390x |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:f77d20eb21bb79808805804465d5e5cdf1f390aa8029a9bad597a0813ff0bf0d_ppc64le as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:36c603b86b770d2ff35a98665471e6441f51ea56ffb819c6ac3d530e86d1f6c9_amd64 as a component of RHACS 4.5 for RHEL 8 | *, advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:36c603b86b770d2ff35a98665471e6441f51ea56ffb819c6ac3d530e86d1f6c9_amd64 |
| Red Hat | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7a5735d8ea892ad522179d10d6c4701798baf1bdbc6ed4b4f555ef2a30738670_s390x as a component of RHACS 4.5 for RHEL 8 | advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7a5735d8ea892ad522179d10d6c4701798baf1bdbc6ed4b4f555ef2a30738670_s390x, advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7a5735d8ea892ad522179d10d6c4701798baf1bdbc6ed4b4f555ef2a30738670_s390x |
| Red Hat | advanced-cluster-security/rhacs-roxctl-rhel8@sha256:f4f22880b6ea0e5b97dd19c311ec00bf650e670373e14aaa29690481503e2fda_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-operator-bundle@sha256:56772b736bb1aec1b10d38d4c2b18bcde17b450b55f8c260ac38b23bd6c85b5c_amd64 as a component of RHACS 4.5 for RHEL 8 | *, *, * |
| Red Hat | advanced-cluster-security/rhacs-central-db-rhel8@sha256:d42f1ed5f7e32313c51f59b5e10d2bafba6c51c3f47a53cec92b3bfeefca9e3c_ppc64le as a component of RHACS 4.5 for RHEL 8 | *, *, * |
…and 62 more
Timeline
- Feb 11, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1334 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2312579 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2335888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2335901 issue
- https://issues.redhat.com/browse/ROX-27932 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1334.json advisory
- https://access.redhat.com/security/cve/CVE-2024-11831 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-11831 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11831 advisory
- https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e advisory
- https://github.com/yahoo/serialize-javascript/pull/173 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
…and 19 more