# CVE-2024-11831: Yahoo serialize-javascript XSS in object serialization

Source: https://junglewise.ai/threats/cve-2024-11831-yahoo-serialize-javascript-xss-in-object-serialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-10. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2024-11831 · Severity: medium · CVSS 5.4 · Published 2025-02-10

A vulnerability exists in a popular JavaScript library used to convert data into a format that can be sent over the web. An attacker could use this flaw to inject malicious scripts into a website, potentially leading to the theft of user session information or unauthorized actions on behalf of visitors. This risk is highest for applications that send complex data types directly to a user's web browser.

Technologies: [serialize-javascript (npm)](https://junglewise.ai/threats/technologies/serialize-javascript). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-11831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-11831 being exploited in the wild.

**How severe is CVE-2024-11831?** Medium severity, with a CVSS score of 5.4, published 10 February 2025.

**Which products and versions are affected?** serialize-javascript (npm) >= 6.0.0, < 6.0.2, SEMVER:introduced=6.0.0,fixed=6.0.2.

**Is there a fix for CVE-2024-11831?** Yes. serialize-javascript (npm): upgrade to 6.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-11831 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-11831?** Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- serialize-javascript (npm): upgrade to 6.0.2 or later

  ```sh
  npm install serialize-javascript@6.0.2
  ```


## Technical details

A Cross-site Scripting (XSS) vulnerability (CWE-79) exists in the npm package 'serialize-javascript' versions 6.0.0 through 6.0.1. The root cause is improper neutralization of input during the serialization of specific JavaScript object types, such as regular expressions (regex). An attacker with the ability to provide input that is subsequently serialized and sent to a client-side environment can inject malicious code. This code executes when the data is deserialized by a web browser. The vulnerability is patched in version 6.0.2.

## Affected products

- Yahoo serialize-javascript >= 6.0.0, < 6.0.2

## Identifiers

- CVE-2024-11831
- GHSA-76p7-773f-r4q5

## Timeline

- 2025-02-10: disclosed
- 2025-02-10: advisory
- 2025-02-10: patched: Version 6.0.2 released

## References

- [https://api.github.com/users/mhassan1](https://api.github.com/users/mhassan1)
- [https://github.com/mhassan1](https://github.com/mhassan1)
- [https://api.github.com/users/mhassan1/gists%7B/gist_id%7D](https://api.github.com/users/mhassan1/gists%7B/gist_id%7D)
- [https://api.github.com/users/mhassan1/repos](https://api.github.com/users/mhassan1/repos)
- [https://avatars.githubusercontent.com/u/8029107?v=4](https://avatars.githubusercontent.com/u/8029107?v=4)
- [https://api.github.com/users/mhassan1/events%7B/privacy%7D](https://api.github.com/users/mhassan1/events%7B/privacy%7D)

## Related threats

- [Yahoo Serialize JavaScript XSS via unescaped script tag in function body](https://junglewise.ai/threats/cve-2026-115897-serialize-javascript-serializes-javascript-values-to-a-superset)
- [serialize-javascript cross-site scripting via unescaped script tag](https://junglewise.ai/threats/cve-2026-115754-serialize-javascript-from-7-0-1-before-7-1-3-contains-a-cross)
- [serialize-javascript XSS via script-closing tag bypass in functions](https://junglewise.ai/threats/cve-2026-97711-serialize-javascript-serializes-javascript-values-to-a-superset)
- [Yahoo serialize-javascript CPU exhaustion DoS via crafted array-like objects](https://junglewise.ai/threats/cve-2026-34043-yahoo-serialize-javascript-cpu-exhaustion-dos-via-crafted-array)
- [serialize-javascript code injection via RegExp.flags and Date.toISOString](https://junglewise.ai/threats/serialize-javascript-code-injection-via-regexp-flags-and-date-a4d4abae)