LowGHSA-mrr8-v49w-3333
sweetalert2 contains potentially undesirable behavior
Published 10 Jul 2023 · Updated 14 Aug 2025
Affected package
sweetalert2npm
- Affected
- >=11.6.14 <11.22.4
- Fixed in
- 11.22.4
Update to the fixed version for your release line, for example:
npm install sweetalert2@11.22.4Details
sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme.
Is GHSA-mrr8-v49w-3333 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sweetalert2, and gives you the command that fixes it.
References
- Linkgithub.com/sweetalert2/sweetalert2/pull/2847
- Linkgithub.com/sweetalert2/sweetalert2/commit/7de85db5c76ba3ef5f0cdbc335bbc4a7c559e012
- Packagegithub.com/sweetalert2/sweetalert2
- Linkgithub.com/sweetalert2/sweetalert2/releases/tag/v11.4.9
- Linkgithub.com/sweetalert2/sweetalert2/tree/6d02e1095e5d9db1dfa7f0708df6fa13a1b32be3#important-notice-about-usage-of-this-software-for-ru-su-and-%D1%80%D1%84-domain-zones
- Linkwww.npmjs.com/package/sweetalert2
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.