VDB
RHSA-2025:8078
RHSA-2025:8078
PUBLISHED
CVSS 5.400000095367432 MEDIUM
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:985b32c82563d070eef0fdfe034ef3f786e936be9906931b39574a8747eee2a8_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:985b32c82563d070eef0fdfe034ef3f786e936be9906931b39574a8747eee2a8_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:919c3f4f4bf163f8060c59a79d12d23dbedbe0e427b8836697f1215898cf8f68_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:919c3f4f4bf163f8060c59a79d12d23dbedbe0e427b8836697f1215898cf8f68_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:58d9bd0b1f38e4cc9328a97fafe60ae73bdb7217b5aa222ea00dfb68f468d429_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8@sha256:58d9bd0b1f38e4cc9328a97fafe60ae73bdb7217b5aa222ea00dfb68f468d429_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-results-watcher-rhel8@sha256:0372c7480defa75a76ea39f720b4d2f99853b84b6ebac6c70a04cf4807801181_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-results-watcher-rhel8@sha256:0372c7480defa75a76ea39f720b4d2f99853b84b6ebac6c70a04cf4807801181_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:8926eb5458c6b6a754b05449dc16ad960343ec7180b84e3251a6c88ad64c4697_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:8926eb5458c6b6a754b05449dc16ad960343ec7180b84e3251a6c88ad64c4697_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-controller-rhel8@sha256:88f2cbf9fae62392766b73fbd2155e41df315e5febea92c9d2daa841e5840c9b_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:6c53c13e00b9e16b36ba24f8fdf4a0249f6fcf5a875cf15fcd4345f985c9c7a8_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:6c53c13e00b9e16b36ba24f8fdf4a0249f6fcf5a875cf15fcd4345f985c9c7a8_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel8@sha256:adf7cb494c19544bc53a673aaf6d64a6f5df7dbf902ca011d540025ec14a0a2e_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel8@sha256:adf7cb494c19544bc53a673aaf6d64a6f5df7dbf902ca011d540025ec14a0a2e_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8@sha256:526176ac856348f1564d155c6f2a53d884e34daa440acb807173531f27a92276_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8@sha256:526176ac856348f1564d155c6f2a53d884e34daa440acb807173531f27a92276_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel8@sha256:918e3ab52312f1b4680614857f88082e57f7206e4f700d81a2e5e80e4c6bd0a6_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel8@sha256:918e3ab52312f1b4680614857f88082e57f7206e4f700d81a2e5e80e4c6bd0a6_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-results-api-rhel8@sha256:9fc719fdcd841e9c6aabca209ad03c32dae160913bc29a9efee070cf168eb35b_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel8@sha256:204ad60f075bb942a19b9aa365b9164424e6fb9d57d729a34554db9b3f9331db_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-nop-rhel8@sha256:204ad60f075bb942a19b9aa365b9164424e6fb9d57d729a34554db9b3f9331db_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:b8ca210fcfb3e296117710ef56a7a9b1e933971887fc398d630bd9be9a2f797d_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:046f5c59ee275e1425281f09308ac3b5d8e7b4683f834fff7a4ce0b0fd82e096_arm64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:046f5c59ee275e1425281f09308ac3b5d8e7b4683f834fff7a4ce0b0fd82e096_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:3c828b862bb69a1af4ce9c23036a115cffa330ecf5e321e73a7d8336ccfdaf49_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:3c828b862bb69a1af4ce9c23036a115cffa330ecf5e321e73a7d8336ccfdaf49_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8@sha256:c304c92d0049366ccd8c59c6dae03b0a59b435433c42568bd5535809fed8fa7f_s390x as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8@sha256:c304c92d0049366ccd8c59c6dae03b0a59b435433c42568bd5535809fed8fa7f_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:7c0151f712895dffe46170337feeb805967e6715315b07060531fb3b7d3d36ee_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-events-rhel8@sha256:7c0151f712895dffe46170337feeb805967e6715315b07060531fb3b7d3d36ee_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel8@sha256:20c02562643fa597b55f47a0b99287dd8163ff0a86577a02ce26224f76aef49a_amd64 as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-resolvers-rhel8@sha256:20c02562643fa597b55f47a0b99287dd8163ff0a86577a02ce26224f76aef49a_amd64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:196b07fad3ae32ccfc9a9d111d05d20e2cdedf7cb25b658006d455f9e760ed59_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8@sha256:196b07fad3ae32ccfc9a9d111d05d20e2cdedf7cb25b658006d455f9e760ed59_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:48db9238b25ae5d5cb9b0900a36a91b7d0156d0ed94e1460acc4d9fb679c1273_ppc64le as a component of Red Hat OpenShift Pipelines 1.15 | registry.redhat.io/openshift-pipelines/pipelines-entrypoint-rhel8@sha256:48db9238b25ae5d5cb9b0900a36a91b7d0156d0ed94e1460acc4d9fb679c1273_ppc64le |
…and 84 more
Timeline
- May 21, 2025 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2025:8078 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/cve/cve-2024-11831 advisory
- https://access.redhat.com/security/cve/cve-2024-48949 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8078.json advisory
- https://access.redhat.com/security/cve/CVE-2024-11831 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2312579 issue
- https://www.cve.org/CVERecord?id=CVE-2024-11831 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11831 advisory
- https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e advisory
- https://github.com/yahoo/serialize-javascript/pull/173 advisory
- https://access.redhat.com/security/cve/CVE-2024-48949 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2317724 issue
- https://www.cve.org/CVERecord?id=CVE-2024-48949 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-48949 advisory
- https://github.com/indutny/elliptic/commit/7ac5360118f74eb02da73bdf9f24fd0c72ff5281 advisory
- https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6 advisory