Update dependency swiper to v12 [SECURITY] by renovate[bot] · Pull Request #69 · AmphiBee/AmphiBlocks

renovate · 2026-02-20T21:06:09Z

This PR contains the following updates:

Package	Change	Age	Confidence
swiper (source)	`^11.0.0` → `^12.0.0`

GitHub Vulnerability Alerts

CVE-2026-27212

Summary

A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2

Details

The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

Install latest version of swiper using npm install
Run the following code snippet:

var swiper = require('swiper');
Array.prototype.indexOf = () => -1;        
let obj = {};
var malicious_payload = '{"__proto__":{"polluted":"yes"}}';
console.log({}.polluted);
swiper.default.extendDefaults(JSON.parse(malicious_payload));
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and prototype pollution occurred

Expected behavior

Prototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted
This is printed on the console:

undefined 
yes

Impact

This is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.
It could potentially lead to the following problems:

Authentication bypass
Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global Array.prototype.indexOf property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service.
Remote code execution (if polluted property is passed to sinks like eval or child_process)

Related CVEs

CVE-2026-25521
CVE-2026-25047
CVE-2026-26021

Release Notes

nolimits4web/Swiper (swiper)

`v12.1.2`

Compare Source

`v12.1.1`

Compare Source

Bug Fixes

a11y: fix focus in virtual mode enabled (3055008), closes #8147
core: avoid double-subtracting offsets in centerInsufficientSlides (#8158) (60b0052)
core: prevent duplicate module initialization in constructor (#8155) (#8156) (07738a2)
types: support boolean as a11y value (#8157) (6bf76d5)

`v12.1.0`

Compare Source

Bug Fixes

autoplay: broken custom delay percentages with pause/resume (#8133) (0afecde)
core: Don't use data-swiper-slide-index for realIndex when virtual module is enabled (#8142) (bd957f8)
core: Escape all CSS selector special characters (d35f41a), closes #8135
core: support slidesOffsetBefore and slidesOffsetAfert in cssMode (45b98d0), closes #7926
fix lazy preloader removal error in react in vue (332f5c7), closes #8149
thumbs: update slide classes on virtual swiper update (#8141) (9752771)
types: Add autoScroll to thumbs.update type signature (#8146) (5d91e6e)
zoom: initialize gesture state after programmatic zoom (#8112) (71e9511)

Features

keyboard: add support for custom speed parameter in keyboard navigation (#8148) (7a4a0e5)
new snapToSlideEdge parameter (de3131f), closes #8021 #4780

`v12.0.3`

Compare Source

Bug Fixes

element: fixed reference to nav arrows SVG (0b17ecf), closes #8115

Features

core: add 'getRotateFix' export to effect utils (c97ae5d), closes #8114

`v12.0.2`

Compare Source

Features

navigation: add styles for when buttons set before slider (4588c57), closes #8085
navigation: new addIcons parameter to add SVG icons to nav buttons (b955b0c), closes #8088 #8087

`v12.0.1`

Compare Source

Bug Fixes

navigation: tweak nav styles when adjacent (98440d9)

`v12.0.0`

Compare Source

Bug Fixes

core: fixes issues when slidesOffsetBefore & slidesOffsetAfter are combinated with centeredSlides, slidesPerView & loop (#8038) (74cc297), closes #7298 #7956 #6916
effect-cards: fix offset in vertical direction when rotate is unset (a248ca1), closes #8075
get-device: regexp tweak (60bb79b), closes #8057
types: correct types for getSlideTransformEl (b34bdce), closes #8054

Features

a11y: add wrapperLiveRegion param to disable wrapper live region in a11y module (#8061) (d03044e)
move to SVG icons for navigation (264603c), closes #6652 #4990
remove LESS and SCSS styles in favor of CSS (118ec66)
virtual: add slidesPerViewAutoSlideSize parameter for fixed slide dimensions with slidesPerView auto (d472144), closes #8041 #7796

`v11.2.10`

Compare Source

Bug Fixes

core: fix clickedIndex with grid (863d8bd)

`v11.2.9`

Compare Source

Bug Fixes

core: clear blank slides within loopCreate() (#8033) (377d53c)
core: escape brackets when transforming classes to selector (#8014) (0c53ee8)
core: slideTo function does not work when grid.rows > 1 (#8030) (1fde9d3)
core: using loop and slideToClickedSlide / slideToLoop with centeredSlides (b6692e2), closes #8031
element: don't set subprops on boolean values (090caa1), closes #8003
keyboard: detect contenteditable element in keyboard module (#8006) (fcd434a)
vue: add missing event (839cafb), closes #8002

`v11.2.8`

Compare Source

Bug Fixes

virtual: fix error in Virtual slides (7a53208), closes #7997

`v11.2.7`

Compare Source

Bug Fixes

core: fix for slideResetTransition events (#7989) (473ec25)
core: set innerHTML using trusted type (8a46954), closes #7961
react,vue: fix not rendered slides in effects when Virtual is enabled (e4e1680), closes #7730
types: add enabled property on swiper-class.d.ts (#7973) (ccd96dc)
types: coverflow effect can be number or string with percentage (#7931) (4d988d8)
types: fix effect param type (#7945) (42eec07)
vue: added missing props (#7966) (6aa8d05)

`v11.2.6`

Compare Source

Bug Fixes

cards/loop: improve loop behavior with cards effect (9a258d4), closes #7917
core: fix initialSlide in loop mode when it there are not enough slides to fill (16818e2), closes #7780
core: fix touchReleaseOnEdges in RTL (d841428), closes #7179

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-20T21:06:10Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: Amphiblocks@1.0.0
npm ERR! Found: @10up/eslint-config@3.0.0
npm ERR! node_modules/@10up/eslint-config
npm ERR!   @10up/eslint-config@"^4.0.0" from the root project
npm ERR!   peer @10up/eslint-config@"^3.0.0" from 10up-toolkit@5.1.0
npm ERR!   node_modules/10up-toolkit
npm ERR!     dev 10up-toolkit@"^6.0.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! @10up/eslint-config@"^4.0.0" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: prettier@3.8.1
npm ERR! node_modules/prettier
npm ERR!   peer prettier@">=3.0.0" from @10up/eslint-config@4.1.4
npm ERR!   node_modules/@10up/eslint-config
npm ERR!     @10up/eslint-config@"^4.0.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-02-20T21_05_55_003Z-debug-0.log

Update dependency swiper to v12 [SECURITY]

2846b71

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Update dependency swiper to v12 [SECURITY]#69

Update dependency swiper to v12 [SECURITY]#69
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-swiper-vulnerability

renovate bot commented Feb 20, 2026

Uh oh!

renovate bot commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Comments

Conversation

renovate bot commented Feb 20, 2026

GitHub Vulnerability Alerts

Summary

Details

PoC

Steps to reproduce

Expected behavior

Actual behavior

Impact

Related CVEs

Release Notes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

renovate bot commented Feb 20, 2026

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants