CVE-2026-27212

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.

• CWE-1321

• https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cfPatch
• https://github.com/nolimits4web/swiper/releases/tag/v12.1.2Product
• https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643Exploit, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27205Flask is a web server gateway interface (WSGI) web applicati…4.3
• CVE-2026-27206Zumba Json Serializer is a library to serialize PHP variable…8.1
• CVE-2026-27208bleon-ethical/api-gateway-deploy provides API gateway deploy…7.8
• CVE-2026-2721The MailArchiver plugin for WordPress is vulnerable to Store…4.8
• CVE-2026-27210Pannellum is a lightweight, free, and open source panorama v…6.1
• CVE-2026-27211Cloud Hypervisor is a Virtual Machine Monitor for Cloud work…10
• CVE-2026-27214Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27215Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27216Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27217Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27218Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27219Substance3D - Painter versions 11.1.2 and earlier are affect…5.5