Description
sweetalert2 versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 10.0.0 - 10.16.9.
Recommendation
Update the sweetalert2 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 10.16.10, < 11.0.0
- Patched version(s): 11.22.4
References
Related Issues
- sweetalert2 v11.4.9 and above contains hidden functionality - Vulnerability
- sweetalert2 v9.17.4 and above contains hidden functionality - Vulnerability
- sweetalert2 v8.19.1 and above contains hidden functionality - Vulnerability
- sweetalert2 contains potentially undesirable behavior - Vulnerability
You might also like:
- Tags:
- npm
- sweetalert2
Anything's wrong? Let us know Last updated on August 25, 2025