Executive brief
Swiper is a popular open-source JavaScript carousel library used in web and mobile applications. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript's global Object.prototype by exploiting how the library processes configuration data. Depending on how downstream applications use polluted properties, this could lead to authentication bypass, denial of service, or remote code execution.
Technical details
A prototype pollution vulnerability exists in Swiper versions 6.5.1 through 12.1.2, located in shared/utils.mjs line 94. The vulnerability arises because a previous fix that checked for forbidden keys using indexOf() can be bypassed by overriding Array.prototype.indexOf to return -1, allowing attackers to inject properties into Object.prototype via __proto__. The attack requires the application to call swiper.extendDefaults() with attacker-controlled JSON input; no network vector or user interaction is required beyond providing malicious configuration. Successful exploitation pollutes the global prototype chain, potentially enabling authentication bypass, denial of service (via crashes when array methods are called), or remote code execution if polluted properties reach dangerous sinks like eval() or child_process. The issue is fixed in version 12.1.2.
Affected products
- nolimits4web Swiper >=6.5.1, <12.1.2
Timeline
- 2026-02-19: disclosed
- 2026-02-19: patched: Fixed in version 12.1.2