1. Home
  2. Vulnerabilities
  3. CVE-2026-27212
9.4
CRITICAL CVSS 4.0
CVE-2026-27212
Swiper has a Prototype Pollution Vulnerability
Description

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.

INFO

Published Date :

Feb. 21, 2026, 6:17 a.m.

Last Modified :

Feb. 24, 2026, 3:16 p.m.

Remotely Exploit :

No

Source :

[email protected]
Affected Products

The following products are affected by CVE-2026-27212 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Swiperjs swiper
: Total Affected Vendor : 1 | Products : 1
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH [email protected]
CVSS 4.0 CRITICAL [email protected]
Solution
Update Swiper to version 12.1.2 or later to fix the prototype pollution vulnerability.
  • Update Swiper to version 12.1.2.
  • Apply security patches provided by the vendor.
  • Review and sanitize all user inputs.
  • Validate data before processing.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-27212.

URL Resource
https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf Patch
https://github.com/nolimits4web/swiper/releases/tag/v12.1.2 Product
https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643 Exploit Vendor Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-27212 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-27212 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-27212 vulnerability anywhere in the article.

  • Daily CyberSecurity
Critical 9.2 Severity Path Traversal Flaw Compromises ASUSTOR FTP Backups

ASUSTOR has released an urgent security statement detailing multiple critical and high-severity vulnerabilities affecting its ASUSTOR Data Master (ADM) operating system.The flaws specifically target t ... Read more

Published Date: Feb 25, 2026 (18 hours, 12 minutes ago)
  • Daily CyberSecurity
Total Takeover: Critical Zyxel Flaw (CVSS 9.8) Exposes Routers to Remote Command Injection

Networking giant Zyxel has rolled out a wave of urgent security patches addressing multiple vulnerabilities across its fleet of 4G LTE/5G NR CPEs, DSL/Ethernet routers, Fiber ONTs, and Wireless Extend ... Read more

Published Date: Feb 25, 2026 (1 day, 2 hours ago)
  • Daily CyberSecurity
CVE-2026-27212: Critical Swiper Prototype Pollution Flaw (CVSS 9.4) Exposes Global Apps

If your web or mobile application relies on smooth, touch-friendly interfaces, there is a high probability you are using Swiper. Universally recognized as “the free and most modern mobile touch slider ... Read more

Published Date: Feb 24, 2026 (2 days, 2 hours ago)
  • Daily CyberSecurity
First-Ever TPM Sniffing Attack Extracts LUKS Keys from Industrial Linux Devices

Image: Cyloq While hardware hackers have long demonstrated the ability to extract BitLocker keys by eavesdropping on Windows systems, a new frontier in Trusted Platform Module (TPM) sniffing has just ... Read more

Published Date: Feb 24, 2026 (2 days, 2 hours ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-27212 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Feb. 24, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CPE Configuration OR *cpe:2.3:a:swiperjs:swiper:*:*:*:*:*:node.js:*:* versions from (including) 6.5.1 up to (excluding) 12.1.2
    Added Reference Type GitHub, Inc.: https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf Types: Patch
    Added Reference Type GitHub, Inc.: https://github.com/nolimits4web/swiper/releases/tag/v12.1.2 Types: Product
    Added Reference Type GitHub, Inc.: https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643 Types: Exploit, Vendor Advisory
  • New CVE Received by [email protected]

    Feb. 21, 2026

    Action Type Old Value New Value
    Added Description Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.
    Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-1321
    Added Reference https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
    Added Reference https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
    Added Reference https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.4
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Base CVSS Score: 7.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact