[GHSA-mrr8-v49w-3333] sweetalert2 v11.6.14 and above contains potentially undesirable behavior #6014
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates a GitHub Security Advisory (GHSA-mrr8-v49w-3333) to reflect that the potentially undesirable behavior in sweetalert2 has been fixed. The advisory originally documented unwanted audio/video messages on specific TLDs, but now indicates the vulnerability was resolved in version 11.22.4.
Key changes:
- Updated the advisory to indicate the vulnerability has been fixed in version 11.22.4
- Modified summary and details to reflect the resolved status
- Removed references that are no longer relevant
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| "summary": "sweetalert2 v11.6.14 and above contains potentially undesirable behavior", | ||
| "details": "`sweetalert2` versions 11.6.14 and above have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme", | ||
| "summary": "potentially undesirable behavior was removed in v11.22.4", | ||
| "details": "The vulnerability was removed from the library", |
There was a problem hiding this comment.
The details field is too vague and unhelpful. It should provide more specific information about what the vulnerability was and how it was fixed, rather than just stating 'The vulnerability was removed from the library'.
| "details": "The vulnerability was removed from the library", | |
| "details": "In sweetalert2 versions 11.6.14 through 11.22.3, a potentially undesirable behavior allowed certain alert dialogs to be triggered or manipulated in ways that could violate expected application behavior, potentially leading to security or usability issues (CWE-440). This issue was addressed in version 11.22.4 by modifying the library's internal logic to prevent such unexpected dialog behavior, ensuring that alerts function as intended and cannot be misused.", |
Copilot uses AI. Check for mistakes.
github-actions
bot
changed the base branch from
main
to
limonte/advisory-improvement-6014
advisory-database
bot
merged commit 9f702b3
into
limonte/advisory-improvement-6014
|
Hi @limonte! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments