VDB
Sign up
LOW

GHSA-pg98-6v7f-2xfv

sweetalert2 v9.17.4 and above contains hidden functionality

Quick fix

GHSA-pg98-6v7f-2xfv — sweetalert2: upgrade to the fixed version with the command below.

npm install sweetalert2@11.22.4

Details

`sweetalert2` versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3.

### Workaround Users who are unable to update to the fixed version (11.22.4) can use package versions 9.0.0-9.17.3, as they do not contain the hidden functionality.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/sweetalert2
Introduced in: 9.17.4Fixed in: 11.22.4
Fixnpm install sweetalert2@11.22.4

References