Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gmtg-5gqw-2bdm
Vulnerability ID VCID-gmtg-5gqw-2bdm
Aliases CVE-2026-27212
GHSA-hmx5-qpq5-p643
Summary Prototype pollution in swiper A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2026-27212
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-hmx5-qpq5-p643
cvssv4 9.4 https://github.com/nolimits4web/swiper
generic_textual CRITICAL https://github.com/nolimits4web/swiper
cvssv4 9.4 https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
generic_textual CRITICAL https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
ssvc Track* https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
cvssv4 9.4 https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
generic_textual CRITICAL https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
ssvc Track* https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
cvssv3.1_qr CRITICAL https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
cvssv4 9.4 https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
generic_textual CRITICAL https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
ssvc Track* https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
cvssv4 9.4 https://nvd.nist.gov/vuln/detail/CVE-2026-27212
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-27212
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-27212
https://github.com/nolimits4web/swiper
https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
CVE-2026-27212 https://nvd.nist.gov/vuln/detail/CVE-2026-27212
GHSA-hmx5-qpq5-p643 https://github.com/advisories/GHSA-hmx5-qpq5-p643
GHSA-hmx5-qpq5-p643 https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
No exploits are available.
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/nolimits4web/swiper
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-24T18:52:46Z/ Found at https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-24T18:52:46Z/ Found at https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-24T18:52:46Z/ Found at https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27212
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.29099
EPSS Score 0.0011
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:06:43.625265+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/swiper/CVE-2026-27212.yml 38.6.0