sweetalert2 contains potentially undesirable behavior
Priority LOW 38CWE-440Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
`sweetalert2` versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme.
Why it matters now
Fix Fixed sweetalert2 (npm): 11.22.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sweetalert2 (npm) | 11.6.14 to before 11.22.4 | 11.22.4 | Patch available | GHSA-mrr8-v49w-3333 |
- sweetalert2 (npm) Vendor— Affected 11.6.14 to before 11.22.4 Fixed in 11.22.4 Patch available GHSA-mrr8-v49w-3333
Remediation
- Fix · GHSA-mrr8-v49w-3333 sweetalert2 (npm) Fixed in 11.22.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-mrr8-v49w-3333
References
Other 6
- https://github.com/sweetalert2/sweetalert2/pull/2847
- https://github.com/sweetalert2/sweetalert2/commit/7de85db5c76ba3ef5f0cdbc335bbc4a7c559e012
- https://github.com/sweetalert2/sweetalert2
- https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9
- https://github.com/sweetalert2/sweetalert2/tree/6d02e1095e5d9db1dfa7f0708df6fa13a1b32be3#important-notice-about-usage-of-this-software-for-ru-su-and-%D1%80%D1%84-domain-zones
- https://www.npmjs.com/package/sweetalert2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences