Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

swiper

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4npmAmendedPublished

    Prototype pollution in swiper

    CVE-2026-27212 · GHSA-hmx5-qpq5-p643

    Affected
    • npm swiper >= 6.5.1, < 12.1.2
    Fixed in
    12.1.2· Vendor fix available
    Issue
    A prototype pollution vulnerability exists in the the npm package swiper (=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2 Details The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings. PoC Steps to reproduce 1. Install latest version of swiper using npm install 2. Run the following code snippet: Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: Actual behavior Object.prototype is polluted This is printed on the console: Impact This is a prototype pollution vulnerability, which can have severe…

    Recommended action: Upgrade to 12.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Critical, CVSS 9.8npmAmendedPublished

    Prototype Pollution in swiper

    CVE-2021-23370 · GHSA-p3hc-fv2j-rp68

    Affected
    • npm swiper < 6.5.1
    Fixed in
    6.5.1· Vendor fix available
    Issue
    Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.

    Recommended action: Upgrade to 6.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →