swiper 0.0.2/6.5.1 prototype pollution

Summaryinfo

A vulnerability was found in swiper and classified as problematic. This affects an unknown part. Executing a manipulation can lead to prototype pollution. This vulnerability appears as CVE-2026-27212. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in swiper and classified as problematic. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-27212. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 12.1.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• swiper

Version

• 0.0.2
• 6.5.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion