CVE-2024-11831 is a cross-site scripting vulnerability in the npm serialize-javascript module version 6.0. The module fails to properly sanitize certain inputs, including regex and other JavaScript object types, enabling attackers to inject malicious code. This code can execute in the context of a web browser when the serialized data is deserialized, potentially compromising the security of web applications using this package. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with no availability impact. Red Hat advisories reference this CVE but do not explicitly confirm a fix or patch for this specific vulnerability. The advisories primarily address .NET 8.0 security updates unrelated to serialize-javascript. No known exploits have been reported.

The vulnerability allows an attacker to inject and execute malicious JavaScript code in a victim's browser via improperly sanitized serialized data. This can lead to cross-site scripting attacks, potentially exposing sensitive information or enabling further attacks within the context of the affected web application. The CVSS score indicates a medium severity impact on confidentiality and integrity, with no impact on availability. No known active exploitation has been reported.

Patch status for CVE-2024-11831 is not confirmed in the provided vendor advisory content. Users should check the official vendor or package repository for updates or patches addressing this vulnerability. Until a patch is available, avoid using vulnerable versions of serialize-javascript (version 6.0) in environments where serialized data is sent to web clients. Implement input validation and output encoding as additional protective measures against XSS. Monitor vendor advisories for official remediation guidance.