VDB
RHSA-2025%3A8512
RHSA-2025%3A8512
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:e3ccadd7ba8e8c3e8e6a20f86b779d44360c5b822ae5f07fa9aa1286d6b3da41_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:e3ccadd7ba8e8c3e8e6a20f86b779d44360c5b822ae5f07fa9aa1286d6b3da41_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:a91b4906b0dac090f5f98bdc554e326fecbed22e94a07e2547213ad5bd0da5e2_ppc64le as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:a91b4906b0dac090f5f98bdc554e326fecbed22e94a07e2547213ad5bd0da5e2_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:95afac8b5caf4a4d320dcbaf599ad213649e37e1fcb963950a110ee8a109c692_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:95afac8b5caf4a4d320dcbaf599ad213649e37e1fcb963950a110ee8a109c692_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:db1807cb3c11899460267146f0c578ad6ede8a3008da7907d98ef78f75983fe2_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8@sha256:db1807cb3c11899460267146f0c578ad6ede8a3008da7907d98ef78f75983fe2_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:97258af0254c6af6c72b05a511a9f789586b0d7fb2d684c900e59c4cd018e5a9_ppc64le as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:97258af0254c6af6c72b05a511a9f789586b0d7fb2d684c900e59c4cd018e5a9_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8@sha256:406517f877eca2bda9cfd946bbf453f7e7cf71038ab25742005dd205c10a85f6_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8@sha256:406517f877eca2bda9cfd946bbf453f7e7cf71038ab25742005dd205c10a85f6_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel8@sha256:97bf81fbd919c1b4c927d50cb0e2dd57f796ebe409ff2cf4427249782c8e4b4d_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-results-retention-policy-agent-rhel8@sha256:97bf81fbd919c1b4c927d50cb0e2dd57f796ebe409ff2cf4427249782c8e4b4d_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:082f23a8a28b734fbb085d7cec25c7d8516dc993f60f62b10e283efd2cef223b_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:082f23a8a28b734fbb085d7cec25c7d8516dc993f60f62b10e283efd2cef223b_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:349986baea785f401fbb5d7615d67d3ea5b50e269504d265c93c8b27f36ee9c6_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:349986baea785f401fbb5d7615d67d3ea5b50e269504d265c93c8b27f36ee9c6_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:e66797179156d8c0dc44157d82306c5a3fecc50ecc7d8a4eb7d36ddbef3a0cbb_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:e66797179156d8c0dc44157d82306c5a3fecc50ecc7d8a4eb7d36ddbef3a0cbb_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:bf45263615b6419c66c523605b1bba9313233c4ce5bce4ae6ce6267b38a70519_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:bf45263615b6419c66c523605b1bba9313233c4ce5bce4ae6ce6267b38a70519_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:791df1fcabbe49d29d549ed3b534f4ad485f9aa94cae3476ba5e0713fbcd197b_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:791df1fcabbe49d29d549ed3b534f4ad485f9aa94cae3476ba5e0713fbcd197b_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:e0daf0f21270e67f9dfe2749d11a188f802a5ff67ec38d207c83b37f1683ea79_ppc64le as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:e0daf0f21270e67f9dfe2749d11a188f802a5ff67ec38d207c83b37f1683ea79_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:7e1591ba7913a5f9834576752c71e02b97ee74beaf8e37be1470e8daf67aaf20_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:7e1591ba7913a5f9834576752c71e02b97ee74beaf8e37be1470e8daf67aaf20_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:082f23a8a28b734fbb085d7cec25c7d8516dc993f60f62b10e283efd2cef223b_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8@sha256:75759139d8a00844682f4e4ec25de8961369b08807746a40c889bd12a8100e64_ppc64le as a component of Red Hat OpenShift Pipelines 1.16 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8@sha256:5247ad821574793b087f1893f468c3da2cbd152aa2796662b3d7746d15668651_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8@sha256:5247ad821574793b087f1893f468c3da2cbd152aa2796662b3d7746d15668651_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:131f6596c1d8cedebe967962e8ffde7e99cc5f64b5335ab1801da430ef0339cf_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8@sha256:e429f4c2eb8849f92fc264ffcabc013af70b70923f07893549103d4ff81198e8_amd64 as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel8@sha256:e429f4c2eb8849f92fc264ffcabc013af70b70923f07893549103d4ff81198e8_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel8@sha256:fe23723685c97386b044714cfd31c85e2928ded9f350c5e62e2f8139e1048759_s390x as a component of Red Hat OpenShift Pipelines 1.16 | registry.redhat.io/openshift-pipelines/pipelines-webhook-rhel8@sha256:fe23723685c97386b044714cfd31c85e2928ded9f350c5e62e2f8139e1048759_s390x |
…and 196 more
Timeline
- Jun 4, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:8512 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/cve/cve-2024-21536 advisory
- https://access.redhat.com/security/cve/cve-2024-11831 advisory
- https://access.redhat.com/security/cve/cve-2024-48949 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8512.json advisory
- https://access.redhat.com/security/cve/CVE-2024-11831 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2312579 issue
- https://www.cve.org/CVERecord?id=CVE-2024-11831 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11831 advisory
- https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e advisory
- https://github.com/yahoo/serialize-javascript/pull/173 advisory
- https://access.redhat.com/security/cve/CVE-2024-21536 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2319884 issue
- https://www.cve.org/CVERecord?id=CVE-2024-21536 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21536 advisory
- https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a advisory
- https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5 advisory
- https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22 advisory
…and 7 more