Executive brief
sweetalert2 is a popular JavaScript library used to display alert dialogs and notifications in web applications. Versions 9.17.4 through 10.0.0 were found to contain hidden functionality that outputs unauthorized audio and video messages unrelated to the library's intended use. This could distract users, disrupt user experience, or be used to spread unwanted messaging to application users without the knowledge of application developers.
Technical details
The vulnerability involves unauthorized hidden functionality injected into sweetalert2 versions 9.17.4 through 10.0.0 by the package maintainer. The issue manifests as embedded audio and/or video output that serves no purpose for the library's core functionality (displaying alert dialogs). The attack vector is supply-chain delivery—any application using affected versions will automatically include the hidden behavior. This is not a traditional code injection vulnerability but rather a case of intentional unwanted code committed by the maintainer. The issue was remediated in version 11.22.4; users can also downgrade to versions 9.0.0–9.17.3 which do not contain the hidden functionality.
Affected products
- sweetalert2 sweetalert2 9.17.4 to 10.0.0, prior to 11.22.4
Timeline
- 2022-11-23: disclosed
- 2022-11-23: patched: Fixed in version 11.22.4