CVE-2026-27212
Published: 21 February 2026
Summary
CVE-2026-27212 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Swiperjs Swiper. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identifying, prioritizing, and applying patches for known flaws like this prototype pollution vulnerability in Swiper versions 6.5.1 through 12.1.1.
Mandates vulnerability scanning to identify the presence of CVE-2026-27212 in deployed Swiper library instances across Node.js and Bun environments.
Requires validating attacker-controlled inputs before processing with Swiper to block crafted payloads exploiting the insufficient indexOf() check for prototype pollution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in Swiper enables local exploitation for privilege escalation (RCE/auth bypass from low-priv context), credential access via authentication bypass, and DoS via object prototype manipulation on Node.js/Bun.
NVD Description
Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check…
more
whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.
Deeper analysisAI
CVE-2026-27212 is a prototype pollution vulnerability in Swiper, a free and mobile touch slider library with hardware accelerated transitions and native behavior. The flaw affects versions 6.5.1 through 12.1.1 and resides in line 94 of shared/utils.mjs, where the indexOf() function checks user-provided input for forbidden strings. A prior fix intended to block prototype pollution by detecting forbidden keys proved insufficient, as crafted input leveraging Array.prototype can still pollute Object.prototype.
The vulnerability requires local access (AV:L) with low privileges (PR:L) and low complexity (AC:L), earning a CVSS v3.1 base score of 7.8 (C:H/I:H/A:H/S:U/UI:N). Local attackers can exploit it in any application processing attacker-controlled input with the affected Swiper versions, potentially achieving authentication bypass, denial of service, or remote code execution. The exploit works across Windows and Linux on Node.js and Bun runtimes.
Swiper version 12.1.2 addresses the issue. The GitHub security advisory (GHSA-hmx5-qpq5-p643), release notes for v12.1.2, and fixing commit (d3e663322a13043ca63aaba235d8cf3900e0c8cf) provide details on the patch and recommend upgrading immediately. This corresponds to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
Details
- CWE(s)