Description
A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype.
Recommendation
Update the swiper package to the latest compatible version. Followings are version details:
- Affected version(s): >= 6.5.1, < 12.1.2
- Patched version(s): 12.1.2
References
Could your website be exposed too?
SmartScanner can check your website for Prototype pollution in swiper - swiper and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CASL Ability is Vulnerable to Prototype Pollution - CVE-2026-1774
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
You might also like:
See something that needs correcting? Let us knowUpdated February 23, 2026