# sweetalert2 hidden functionality in alert dialogs

Source: https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-alert-dialogs-5fc44f4d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2022-11-23

sweetalert2 is a popular JavaScript library used by developers to display custom alert dialogs in web applications. Versions 10.16.10 through 11.0.0 were found to contain hidden functionality that outputs unexpected audio and video messages without the developer's knowledge or consent. This undocumented behavior could affect user experience and raise security and privacy concerns in applications relying on this library.

Technologies: [sweetalert2 (npm)](https://junglewise.ai/threats/technologies/sweetalert2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 23 November 2022.

**Which products and versions are affected?** sweetalert2 (npm) SEMVER:introduced=10.16.10,fixed=11.22.4.

**Is there a fix for This vulnerability?** Yes. sweetalert2 (npm): upgrade to 11.22.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run sweetalert2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sweetalert2 (npm): upgrade to 11.22.4 or later

  ```sh
  npm install sweetalert2@11.22.4
  ```


## Technical details

The vulnerability involves undocumented code (CWE-912: Hidden Functionality) introduced in sweetalert2 version 10.16.10 that causes the library to emit audio and/or video content not related to its documented alert dialog functionality. The hidden functionality was intentionally added by the library maintainer and does not appear in versions 10.0.0–10.16.9 or in versions 11.22.4 and above. Affected versions include 10.16.10 through 11.0.0 and later versions until 11.22.4. No authentication or special network access is required; the code executes automatically when the affected library version is loaded. An attacker could exploit this via supply-chain mechanisms or by encouraging use of affected versions. The fix is to upgrade to version 11.22.4 or later, or downgrade to version 10.16.9 or earlier.

## Affected products

- sweetalert2 sweetalert2 10.16.10 through 11.22.3

## Timeline

- 2022-11-23: disclosed
- 2022-11-23: patched: Fix released in version 11.22.4

## References

- [https://github.com/sweetalert2/sweetalert2](https://github.com/sweetalert2/sweetalert2)
- [https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9](https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9)
- [https://www.npmjs.com/package/sweetalert2](https://www.npmjs.com/package/sweetalert2)

## Related threats

- [sweetalert2 undesirable behavior on specific TLDs](https://junglewise.ai/threats/sweetalert2-undesirable-behavior-on-specific-tlds-fd4b5ac4)
- [sweetalert2 hidden functionality and protestware](https://junglewise.ai/threats/sweetalert2-hidden-functionality-and-protestware-03d50cb7)
- [sweetalert2 hidden functionality in versions 9.17.4 through 10.0.0](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-versions-9-17-4-through-10-0-0-c94c7cec)
- [sweetalert2 hidden functionality in package initialization](https://junglewise.ai/threats/sweetalert2-hidden-functionality-in-package-initialization-f7a140e3)