Prototype Pollution Vulnerability in Swiper Product by Nolimits4web

CVE-2026-27212

What is CVE-2026-27212?

The Swiper framework, widely used for mobile touch slider functionality, contains a prototype pollution issue affecting versions 6.5.1 to 12.1.1. The vulnerability exists due to improper handling of user input in shared/utils.mjs, specifically at line 94 where the indexOf() function fails to adequately filter forbidden strings. This oversight allows attackers to potentially manipulate Object.prototype through crafted inputs utilizing Array.prototype, impacting applications on both Windows and Linux platforms and across various JavaScript runtimes like Node and Bun. Applications leveraging this framework to process untrusted user input may face security risks including authentication bypass, denial of service, and remote code execution. Version 12.1.2 addresses this critical vulnerability.

References