CVE-2026-27212
Swiperjs Swiper 6.5.1 – 12.1.2
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-27212 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Swiperjs Swiper. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27212 is a prototype pollution vulnerability in Swiper, a free and mobile touch slider library with hardware accelerated transitions and native behavior. The flaw affects versions 6.5.1 through 12.1.1 and resides in line 94 of shared/utils.mjs, where the indexOf() function checks user-provided input for forbidden strings. A prior fix intended to block prototype pollution by detecting forbidden keys proved insufficient, as crafted input leveraging Array.prototype can still pollute Object.prototype.
The vulnerability requires local access (AV:L) with low privileges (PR:L) and low complexity (AC:L), earning a CVSS v3.1 base score of 7.8 (C:H/I:H/A:H/S:U/UI:N). Local attackers can exploit it in any application processing attacker-controlled input with the affected Swiper versions, potentially achieving authentication bypass, denial of service, or remote code execution. The exploit works across Windows and Linux on Node.js and Bun runtimes.
Swiper version 12.1.2 addresses the issue. The GitHub security advisory (GHSA-hmx5-qpq5-p643), release notes for v12.1.2, and fixing commit (d3e663322a13043ca63aaba235d8cf3900e0c8cf) provide details on the patch and recommend upgrading immediately. This corresponds to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7728
Vulnerability Data
Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check…
more
whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure development lifecycle mandates input validation and object-handling controls that directly prevent prototype pollution.
Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.