Description
sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3.
Recommendation
Update the sweetalert2 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 9.17.4, < 10.0.0
- Patched version(s): 11.22.4
References
Related Issues
- sweetalert2 v11.4.9 and above contains hidden functionality - Vulnerability
- sweetalert2 v10.16.10 and above contains hidden functionality - Vulnerability
- sweetalert2 v8.19.1 and above contains hidden functionality - Vulnerability
- sweetalert2 contains potentially undesirable behavior - Vulnerability
You might also like:
- Tags:
- npm
- sweetalert2
Anything's wrong? Let us know Last updated on September 24, 2025