Description
sweetalert2 versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 11.0.0 - 11.4.8.
Recommendation
Update the sweetalert2 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 11.4.9, < 11.6.14
- Patched version(s): 11.22.4
References
Related Issues
- sweetalert2 v10.16.10 and above contains hidden functionality - Vulnerability
- sweetalert2 v9.17.4 and above contains hidden functionality - Vulnerability
- sweetalert2 v8.19.1 and above contains hidden functionality - Vulnerability
- sweetalert2 contains potentially undesirable behavior - Vulnerability
You might also like:
- Tags:
- npm
- sweetalert2
Anything's wrong? Let us know Last updated on August 25, 2025