Nixpkgs Security Tracker

Permalink CVE-2024-11831

created 4 months, 3 weeks ago

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Affected products

pcs

ceph

pybind

grafana

libarrow

dotnet6.0

dotnet7.0

dotnet8.0

nodejs-webpack

quay/quay-rhel8

mta/mta-ui-rhel9

mta/mta-cli-rhel9

rh-dotnet60-dotnet

rhdh-hub-container

odf4/mcg-core-rhel8

odf4/mcg-core-rhel9

odh-dashboard-rhel8

rhdh/rhdh-hub-rhel9

devspaces/code-rhel8

rhacm2/console-rhel8

rhacm2/console-rhel9

serialize-javascript

<6.0.2

automation-controller

rhceph/rhceph-8-rhel9

aap-cloud-ui-container

odf4/odf-console-rhel9

odh-operator-container

openshift3/ose-console

devspaces/traefik-rhel8

odh-dashboard-container

rhdh-operator-container

odh-model-registry-rhel8

automation-eda-controller

devspaces/dashboard-rhel8

rhosdt/jaeger-agent-rhel8

rhosdt/jaeger-query-rhel8

discovery-server-container

3scale-amp-system-container

rhosdt/jaeger-ingester-rhel8

odf4/ocs-client-console-rhel9

odh-ml-pipelines-driver-rhel8

odh-notebook-controller-rhel8

rhosdt/jaeger-collector-rhel8

nodejs-uglifyjs-webpack-plugin

rhosdt/jaeger-all-in-one-rhel8

odh-ml-pipelines-launcher-rhel8

openshift-logging/kibana6-rhel8

rhosdt/jaeger-es-rollover-rhel8

odh-kf-notebook-controller-rhel8

nodejs-compression-webpack-plugin

openshift-service-mesh/kiali-rhel8

nodejs-css-minimizer-webpack-plugin

odf4/odf-multicluster-console-rhel8

odf4/odf-multicluster-console-rhel9

odh-ml-pipelines-api-server-v2-rhel8

rhosdt/jaeger-es-index-cleaner-rhel8

openshift4/ose-monitoring-plugin-rhel8

openshift4/ose-monitoring-plugin-rhel9

openshift-service-mesh/kiali-ossmc-rhel8

rhtpa/rhtpa-trustification-service-rhel9

advanced-cluster-security/rhacs-main-rhel8

odh-ml-pipelines-persistenceagent-v2-rhel8

openshift-pipelines/pipelines-hub-ui-rhel8

odh-ml-pipelines-scheduledworkflow-v2-rhel8

openshift-pipelines/pipelines-hub-api-rhel8

advanced-cluster-security/rhacs-roxctl-rhel8

advanced-cluster-security/rhacs-rhel8-operator

odh-data-science-pipelines-argo-argoexec-rhel8

ansible-automation-platform-24/lightspeed-rhel8

ansible-automation-platform-25/lightspeed-rhel8

advanced-cluster-security/rhacs-central-db-rhel8

advanced-cluster-security/rhacs-scanner-v4-rhel8

openshift-pipelines-console-plugin-rhel8-container

openshift-pipelines/pipelines-console-plugin-rhel8

openshift-pipelines/pipelines-console-plugin-rhel9

advanced-cluster-security/rhacs-scanner-v4-db-rhel8

openshift-pipelines/pipelines-hub-db-migration-rhel8

odh-data-science-pipelines-argo-workflowcontroller-rhel8

migration-toolkit-virtualization/mtv-console-plugin-rhel9

openshift-lightspeed-beta/lightspeed-console-plugin-rhel9

Matching in nixpkgs

pkgs.vpcs

Simple virtual PC simulator

nixos-unstable -
- nixpkgs-unstable 0.8.3

pkgs.pcsx2

Playstation 2 emulator

nixos-unstable -
- nixpkgs-unstable 2.4.0

pkgs.rpcs3

PS3 emulator/debugger

nixos-unstable -
- nixpkgs-unstable 0.0.37

pkgs.pcstat

Page Cache stat: get page cache stats for files on Linux

nixos-unstable -
- nixpkgs-unstable 0.0.2

pkgs.grafana

Gorgeous metric viz, dashboards & editors for Graphite, InfluxDB & OpenTSDB

nixos-unstable -
- nixpkgs-unstable 12.1.1

pkgs.pcsclite

Middleware to access a smart card using SCard API (PC/SC)

nixos-unstable -
- nixpkgs-unstable 2.3.0

pkgs.appcsxcad

Minimal Application using the QCSXCAD library

nixos-unstable -
- nixpkgs-unstable 0.2.3

pkgs.pcsctools

Tools used to test a PC/SC driver, card or reader

nixos-unstable -
- nixpkgs-unstable 1.7.3

pkgs.pcsx2-bin

Playstation 2 emulator (precompiled binary, repacked from official website)

nixos-unstable -
- nixpkgs-unstable 2.4.0

pkgs.grafanactl

Tool designed to simplify interaction with Grafana instances

nixos-unstable -
- nixpkgs-unstable 0.1.3

pkgs.baidupcs-go

Baidu Netdisk commandline client, mimicking Linux shell file handling commands

nixos-unstable -
- nixpkgs-unstable 3.9.9

pkgs.mcp-grafana

MCP server for Grafana

nixos-unstable -
- nixpkgs-unstable 0.6.5

pkgs.grafana-loki

Like Prometheus, but for logs

nixos-unstable -
- nixpkgs-unstable 3.5.5

pkgs.pcsc-safenet

Safenet Authentication Client

nixos-unstable -
- nixpkgs-unstable 10.8.1050

pkgs.rpcsvc-proto

This package contains rpcsvc proto.x files from glibc, which are missing in libtirpc

nixos-unstable -
- nixpkgs-unstable 1.4.4

pkgs.grafana-alloy

Open source OpenTelemetry Collector distribution with built-in Prometheus pipelines and support for metrics, logs, traces, and profiles

nixos-unstable -
- nixpkgs-unstable 1.10.2

pkgs.grafana-kiosk

Kiosk Utility for Grafana

nixos-unstable -
- nixpkgs-unstable 1.0.9

pkgs.libretro.pcsx2

Port of PCSX2 to libretro

nixos-unstable -
- nixpkgs-unstable pcsx2-0-unstable-2025-08-30

pkgs.pcsc-cyberjack

REINER SCT cyberJack USB chipcard reader user space driver

nixos-unstable -
- nixpkgs-unstable 3.99.5

pkgs.grafana-to-ntfy

Bridge to forward Grafana alerts to ntfy.sh notification service

nixos-unstable -
- nixpkgs-unstable 0-unstable-2025-01-25

pkgs.pcsc-scm-scl011

SCM Microsystems SCL011 chipcard reader user space driver

nixos-unstable -
- nixpkgs-unstable 2.09

pkgs.pcscliteWithPolkit

Middleware to access a smart card using SCard API (PC/SC)

nixos-unstable -
- nixpkgs-unstable 2.3.0

pkgs.grafana-dash-n-grab

Grafana Dash-n-Grab (gdg) -- backup and restore Grafana dashboards, datasources, and other entities

nixos-unstable -
- nixpkgs-unstable 0.8.1

pkgs.libretro.pcsx_rearmed

Port of PCSX ReARMed to libretro

nixos-unstable -
- nixpkgs-unstable 0-unstable-2025-08-16

pkgs.vsmartcard-pcsc-relay

Relays a smart card using an contact-less interface

nixos-unstable -
- nixpkgs-unstable 0.9-unstable-2025-01-25

pkgs.haskellPackages.gpcsets

Generalized Pitch Class Sets for Haskell

nixos-unstable -
- nixpkgs-unstable 0.9.2.0

pkgs.dhallPackages.dhall-grafana

None

nixos-unstable -
- nixpkgs-unstable 49a3ee4801cf64f479e3f0bad839a5dd8e5b4932

pkgs.terraform-providers.grafana

None

nixos-unstable -
- nixpkgs-unstable 4.5.3

pkgs.python312Packages.grafanalib

Library for building Grafana dashboards

nixos-unstable -
- nixpkgs-unstable 0.7.1

pkgs.python313Packages.grafanalib

Library for building Grafana dashboards

nixos-unstable -
- nixpkgs-unstable 0.7.1

pkgs.haskellPackages.amazonka-grafana

Amazon Managed Grafana SDK

nixos-unstable -
- nixpkgs-unstable 2.0

pkgs.grafanaPlugins.grafana-oncall-app

Developer-friendly incident response for Grafana

nixos-unstable -
- nixpkgs-unstable 1.16.5

pkgs.grafanaPlugins.grafana-clock-panel

Clock panel for Grafana

nixos-unstable -
- nixpkgs-unstable 2.1.9

pkgs.grafanaPlugins.grafana-pyroscope-app

Integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data