Read the docs
TI-2026-21645 Aliases CVE-2026-27212GHSA-hmx5-qpq5-p643

Swiper has a Prototype Pollution Vulnerability

Priority HIGH 76CWE-1321Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed swiper (nolimits4web): 12.1.2swiper (npm): 12.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nolimits4webswiper6.5.1 to before 12.1.212.1.2Patch availableCNA
—swiper (npm)6.5.1 to before 12.1.212.1.2Patch availableGHSA-hmx5-qpq5-p643
  • swiper Vendornolimits4web Affected 6.5.1 to before 12.1.2 Fixed in 12.1.2 Patch available CNA
  • swiper (npm) Vendor— Affected 6.5.1 to before 12.1.2 Fixed in 12.1.2 Patch available GHSA-hmx5-qpq5-p643

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:swiperjs:swiper:*:*:*:*:*:node.js:*:*6.5.1 to before 12.1.2VulnerableSwiperjs
  • cpe:2.3:a:swiperjs:swiper:*:*:*:*:*:node.js:*:* Versions 6.5.1 to before 12.1.2 Vulnerable ·Swiperjs

Remediation

  • Fix · CNA swiper (nolimits4web) Fixed in 12.1.2
  • Fix · GHSA-hmx5-qpq5-p643 swiper (npm) Fixed in 12.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27212
  2. 2026-10-03 Alias added: GHSA-hmx5-qpq5-p643

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-26761 adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the… CVSS 3.1MEDIUM 6.5
  • TI-2024-26140 adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the… CVSS 3.1MEDIUM 6.5
  • TI-2024-26138 adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the… CVSS 3.1MEDIUM 6.5
  • TI-2021-06063 Prototype pollution in swiper CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences