sweetalert2 contains potentially undesirable behavior

Description

sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project’s readme.

Recommendation

Update the sweetalert2 package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.6.14, < 11.22.4
• Patched version(s): 11.22.4

References

• GHSA-mrr8-v49w-3333
• www.npmjs.com
• CWE-440

Related Issues

• sweetalert2 v11.4.9 and above contains hidden functionality - Vulnerability
• sweetalert2 v10.16.10 and above contains hidden functionality - Vulnerability
• sweetalert2 v8.19.1 and above contains hidden functionality - Vulnerability
• sweetalert2 v9.17.4 and above contains hidden functionality - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

sweetalert2