CVE-2026-27212 Swiper has a Prototype Pollution Vulnerability
Prototype pollution in Swiper allows attackers to achieve remote code execution, privilege escalation, or denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27212?
CVE-2026-27212 is a critical unsafe deserialization vulnerability in nolimits4web swiper, published on 21 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.
Weakness: CWE-1321
Which versions are affected by CVE-2026-27212?
2 open source packages ship an affected version, including swiper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
swiper npm | From 6.5.1 | 12.1.2 |
swiper npm | From 6.5.1 | 12.1.2 |
Products include Swiperjs Swiper.
How do I fix CVE-2026-27212?
Upgrade swiper to 12.1.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-27212 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27212 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in nolimits4web swiper
Sources
Also known as CLSA-2026-1773620188, CLSA-2026-1783731814, GHSA-hmx5-qpq5-p643.