Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 23 November 2022.
- Which products and versions are affected?
- sweetalert2 (npm) 11.4.9 to 11.22.3.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked with local access, in a software library.
- Am I affected?
- Check whether you run sweetalert2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
sweetalert2 versions 11.4.9 and above contain hidden initialization code that outputs audio and/or video messages not documented in the library's API or release notes. The code was intentionally introduced by the maintainer and was absent in versions 11.0.0 through 11.4.8. The hidden functionality executes during normal package loading without explicit developer consent or awareness. While not a traditional security vulnerability that enables unauthorized access, this behavior violates user expectations and library transparency. The vulnerability was resolved in version 11.22.4.
Affected products
- npm sweetalert2 11.4.9 to 11.22.3
Timeline
- 2022-11-23: disclosed