Prototype Pollution Vulnerability in Swiper Product by Nolimits4web
CVE-2026-27212
Key Information:
- Vendor
Nolimits4web
- Status
- Vendor
- CVE Published:
- 21 February 2026
Badges
What is CVE-2026-27212?
The Swiper framework, widely used for mobile touch slider functionality, contains a prototype pollution issue affecting versions 6.5.1 to 12.1.1. The vulnerability exists due to improper handling of user input in shared/utils.mjs, specifically at line 94 where the indexOf() function fails to adequately filter forbidden strings. This oversight allows attackers to potentially manipulate Object.prototype through crafted inputs utilizing Array.prototype, impacting applications on both Windows and Linux platforms and across various JavaScript runtimes like Node and Bun. Applications leveraging this framework to process untrusted user input may face security risks including authentication bypass, denial of service, and remote code execution. Version 12.1.2 addresses this critical vulnerability.
Affected Version(s)
swiper >= 6.5.1, < 12.1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.