PT-2023-33044 · Unknown · Sweetalert2

Published 2023-07-10 · Updated 2023-07-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions sweetalert2 versions 11.6.14 and above

Description The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains (TLDs). This behavior is documented in the project's readme file.

Recommendations For sweetalert2 versions 11.6.14 and above, consider disabling the audio and video message functionality as a temporary workaround until a more suitable solution is available.

Weakness Enumeration

CWE-440

Related Identifiers

GHSA-MRR8-V49W-3333

Affected Products

Sweetalert2

References · 7

• https://osv.dev/vulnerability/GHSA-mrr8-v49w-3333 · Vendor Advisory
• https://github.com/sweetalert2/sweetalert2 · Note
• https://github.com/sweetalert2/sweetalert2/commit/7de85db5c76ba3ef5f0cdbc335bbc4a7c559e012 · Note
• https://github.com/sweetalert2/sweetalert2/pull/2847 · Note
• https://github.com/sweetalert2/sweetalert2/tree/6d02e1095e5d9db1dfa7f0708df6fa13a1b32be3#important-notice-about-usage-of-this-software-for-ru-su-and-%D1%80%D1%84-domain-zones · Note
• https://github.com/sweetalert2/sweetalert2/releases/tag/v11.4.9 · Note
• https://npmjs.com/package/sweetalert2 · Note