sweetalert2 v8.19.1 and above contains hidden functionality
Priority LOW 38CWE-912Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
`sweetalert2` versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions below 8.19.1. ### Workaround Users who are unable to update to the fixed version (11.22.4) can use package versions 8.19.0 and below, as they do not contain the hidden functionality.
Why it matters now
Fix Fixed sweetalert2 (npm): 11.22.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sweetalert2 (npm) | 8.19.1 to before 11.22.4 | 11.22.4 | Patch available | GHSA-8jh9-wqpf-q52c |
- sweetalert2 (npm) Vendor— Affected 8.19.1 to before 11.22.4 Fixed in 11.22.4 Patch available GHSA-8jh9-wqpf-q52c
Remediation
- Fix · GHSA-8jh9-wqpf-q52c sweetalert2 (npm) Fixed in 11.22.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-8jh9-wqpf-q52c
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences