GHSA-pg98-6v7f-2xfv

Suggest an improvement
Source
https://github.com/advisories/GHSA-pg98-6v7f-2xfv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-pg98-6v7f-2xfv/GHSA-pg98-6v7f-2xfv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pg98-6v7f-2xfv
Published
2022-11-23T15:44:52Z
Modified
2022-11-23T15:44:52Z
Summary
sweetalert2 v9.17.4 and above contains hidden functionality
Details

sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3.

Workaround

Use a version 9.0.0 - 9.17.3 of the package until the maintainer releases a fix.

Database specific
{
    "nvd_published_at": null,
    "github_reviewed_at": "2022-11-23T15:44:52Z",
    "github_reviewed": true,
    "severity": "LOW",
    "cwe_ids": [
        "CWE-912"
    ]
}
References

Affected packages

npm / sweetalert2

Package

Affected ranges

Type
SEMVER
Events
Introduced
9.17.4

Database specific

{
    "last_known_affected_version_range": "< 10.0.0"
}