sweetalert2 v11.4.9 and above contains hidden functionality

published 2022-11-23 3y ago modified 2025-08-25 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

`sweetalert2` versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 11.0.0 - 11.4.8.

### Workaround Use a version 11.0.0 - 11.4.8 of the package until the maintainer releases a fix.

Patch / fix

fixed in 1 links 1

npm sweetalert2 11.22.4

github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9 release

Is GHSA-qq6h-5g6j-q3cm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	sweetalert2	>=11.4.9, <11.22.4	11.22.4

Classification

Weakness

CWE-912 Hidden Functionality

References

Sources

GitHub Advisory GHSA-qq6h-5g6j-q3cm

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.