Executive brief
Swiper is a popular JavaScript carousel/slider library used on websites to display image galleries and content. A prototype pollution vulnerability in versions before 6.5.1 allows attackers to manipulate the underlying JavaScript object prototype, potentially leading to unauthorized code execution or data manipulation on websites using the vulnerable library.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the Swiper library's object extension function, which improperly merges configuration objects without adequately filtering special keys like "__proto__". An attacker can exploit this by providing malicious configuration options that pollute the JavaScript Object prototype, affecting all objects in the application. The vulnerability is network-accessible and requires no authentication or user interaction—a malicious website or compromised dependency can trigger the flaw. Successful exploitation enables arbitrary property injection into all JavaScript objects, potentially leading to privilege escalation, data exfiltration, or remote code execution depending on application context. The fix was released in version 6.5.1 (March 29, 2021), which properly sanitizes keys during object merging.
Affected products
- nolimits4web Swiper before 6.5.1
Timeline
- 2021-04-12: disclosed
- 2021-03-29: patched: Version 6.5.1 released