PT-2026-21358 · Swiper · Swiper

Kevgeoleo + 2 · Published 2026-02-19 · Updated 2026-05-19 · CVE-2026-27212

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Swiper versions 6.5.1 through 12.1.1

Description Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. A prototype pollution issue exists in the shared/utils.mjs file, specifically at line 94, where the indexOf() function is used to validate user-provided input. Despite a prior attempt to address prototype pollution by checking for forbidden keys, it remains possible to pollute Object.prototype using a crafted input leveraging Array.prototype. This issue impacts Windows and Linux systems, as well as Node and Bun runtimes. Applications processing attacker-controlled input with this package may be susceptible to Authentication Bypass, Denial of Service, and Remote Code Execution (RCE).

Recommendations Update to version 12.1.2 to resolve this issue.

Exploit

Fix

DoS

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-27212

GHSA-HMX5-QPQ5-P643

Affected Products

Swiper

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27212.json · Exploit
• https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643 · Vendor Advisory
• https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf · Patch
• https://osv.dev/vulnerability/CVE-2026-27212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27212 · Security Note
• https://osv.dev/vulnerability/GHSA-hmx5-qpq5-p643 · Vendor Advisory
• https://github.com/nolimits4web/swiper · Note
• https://github.com/nolimits4web/swiper/releases/tag/v12.1.2 · Note
• https://t.me/cveNotify/152701 · Telegram Post
• https://reddit.com/r/elementor/comments/1thi3p4/elementor_408_vulnerable_js_library_swiper_845 · Reddit Post
• https://twitter.com/CVEnew/status/2025154183301595556 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/2026181613982199839 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2026110670425530617 · Twitter Post
• https://t.me/CVEtracker/45354 · Telegram Post
• https://twitter.com/vuln_tracker/status/2026116439376326752 · Twitter Post