Swiper has a Prototype Pollution Vulnerability

Vulnerability

Overview

A prototype pollution vulnerability exists in the Swiper package (versions 6.5.1 to 12.1.1). The issue is in line 94 of shared/utils.mjs, where the indexOf() function is used to check if user-supplied input contains forbidden strings. Despite a previous fix that attempted to block prototype pollution by checking for forbidden keys, the check can be bypassed if an attacker overrides Array.prototype.indexOf to always return -1. This allows the attacker to pollute Object.prototype via a crafted JSON payload containing __proto__ keys. [2][3]

Exploitation

An attacker can exploit this vulnerability by passing attacker-controlled input (e.g., parsed JSON) to any Swiper function that processes such input, such as extendDefaults. On Node.js and Bun runtimes, the exploit works across Windows and Linux. The attacker must be able to influence the input processed by the package, which is common in applications that handle user data. [3]

Impact

Successful prototype pollution can have severe consequences, including authentication bypass (if polluted properties affect authentication logic), denial of service (if the global Array.prototype.indexOf is overridden, causing Swiper to crash), and potentially remote code execution if the polluted properties are used in subsequent code paths. [2][3]

Mitigation

The vulnerability is fixed in Swiper version 12.1.2. Users should update to this version or later. No workarounds are provided in the advisory. [4]