[GHSA-8jh9-wqpf-q52c] sweetalert2 v8.19.1 and above contains hidden functionality #6030
Conversation
There was a problem hiding this comment.
Pull Request Overview
Updates a security advisory for sweetalert2 to correct the patched version tagging and add CVSS v3 scoring information. The changes address the comment that the patched version was not tagged correctly.
- Updates the modified timestamp to reflect recent changes
- Adds CVSS v3 severity scoring with a null impact score
- Corrects the version range format by adding a proper "fixed" event instead of using "last_known_affected_version_range"
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| "severity": [ | ||
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" |
There was a problem hiding this comment.
The CVSS score shows all impact metrics (Confidentiality, Integrity, Availability) as 'N' (None), which results in a base score of 0.0. This indicates no security impact, which seems inconsistent with classifying this as a security vulnerability. Consider reviewing if this is the appropriate CVSS score for hidden functionality that could affect user trust and application behavior.
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" | |
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" |
Copilot uses AI. Check for mistakes.
Updates
Comments
patched version not tagged correctly