{"answers":{"affected":"2 open source packages ship an affected version, including swiper. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27212 exists.","fix":"Upgrade swiper to 12.1.2 or later.","what":"CVE-2026-27212 is a critical unsafe deserialization vulnerability in nolimits4web swiper, published on 21 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-27212 and fix it if it is affected.\n\nWhat it is: CVE-2026-27212 is a critical unsafe deserialization vulnerability in nolimits4web swiper, published on 21 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27212 exists.\n\nAffected packages and fixed versions:\n- swiper (npm): affected from 6.5.1; fixed in 12.1.2\n- swiper (npm): affected from 6.5.1; fixed in 12.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27212/ (Markdown: https://insights.sbomify.com/CVE-2026-27212/index.md)","id":"CVE-2026-27212","markdown":"https://insights.sbomify.com/CVE-2026-27212/index.md","name":"CVE-2026-27212","record":{"aliases":["CLSA-2026-1773620188","CLSA-2026-1783731814","GHSA-hmx5-qpq5-p643"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","privilege_escalation","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"JavaScript slider library","requires_auth":"none","summary":"Prototype pollution in Swiper allows attackers to achieve remote code execution, privilege escalation, or denial of service via crafted input.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"swiper","vendor":"swiperjs"}],"cvss":{"score":9.4,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"description":"Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes.  Any application that processes attacker-controlled input using this package may be affected  by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":"2026-06-02","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-06-02T11:05:13Z","kind":"github_poc","ref":"https://github.com/stealth-factory/resize-image-before-upload-secure","stars":1,"title":"Security-hardened fork of the WordPress plugin \"Resize Image Before Upload\" — removes all ads/promotions and the bundled Swiper 8.2.4 library (CVE-2026-27212, CRITICAL). Core client-side image-resize feature unchanged. GPLv3."}],"tier":"weaponised"},"has_fix":true,"headline":"Swiper has a Prototype Pollution Vulnerability","id":"CVE-2026-27212","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"deserialization","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Substance3D - Painter | NULL Pointer Dereference (CWE-476)","id":"CVE-2026-27214"},"packages":[{"ecosystem":"npm","fixed":["12.1.2"],"introduced":["6.5.1"],"last_affected":[],"package":"swiper","purl":null,"source":"GHSA-hmx5-qpq5-p643"},{"ecosystem":"npm","fixed":["12.1.2"],"introduced":["6.5.1"],"last_affected":[],"package":"swiper","purl":"pkg:npm/swiper","source":"GHSA-hmx5-qpq5-p643"}],"prev":{"headline":"Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse","id":"CVE-2026-27211"},"products":["swiper"],"published":"2026-02-21","related":[{"cvss_score":7.5,"headline":"Prototype Pollution","id":"CVE-2021-23370","kev_date_added":null,"published":"2021-04-12"},{"cvss_score":6.5,"headline":"adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults","id":"CVE-2024-38997","kev_date_added":null,"published":"2024-07-01"},{"cvss_score":6.5,"headline":"Code injection in n/a","id":"CVE-2024-39000","kev_date_added":null,"published":"2024-07-01"},{"cvss_score":6.5,"headline":"Code injection in n/a","id":"CVE-2024-39853","kev_date_added":null,"published":"2024-07-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-02-24","vendors":["nolimits4web"]},"summary":"Prototype pollution in Swiper allows attackers to achieve remote code execution, privilege escalation, or denial of service via crafted input.","url":"https://insights.sbomify.com/CVE-2026-27212/"}