Executive brief
sweetalert2 is a popular JavaScript library used by developers to display custom alert dialogs in web applications. Versions 10.16.10 through 11.0.0 were found to contain hidden functionality that outputs unexpected audio and video messages without the developer's knowledge or consent. This undocumented behavior could affect user experience and raise security and privacy concerns in applications relying on this library.
Technical details
The vulnerability involves undocumented code (CWE-912: Hidden Functionality) introduced in sweetalert2 version 10.16.10 that causes the library to emit audio and/or video content not related to its documented alert dialog functionality. The hidden functionality was intentionally added by the library maintainer and does not appear in versions 10.0.0–10.16.9 or in versions 11.22.4 and above. Affected versions include 10.16.10 through 11.0.0 and later versions until 11.22.4. No authentication or special network access is required; the code executes automatically when the affected library version is loaded. An attacker could exploit this via supply-chain mechanisms or by encouraging use of affected versions. The fix is to upgrade to version 11.22.4 or later, or downgrade to version 10.16.9 or earlier.
Affected products
- sweetalert2 sweetalert2 10.16.10 through 11.22.3
Timeline
- 2022-11-23: disclosed
- 2022-11-23: patched: Fix released in version 11.22.4