The vulnerability is a prototype pollution flaw in Swiper versions 6.5.1 through 12.1.1, located in shared/utils.mjs where an indexOf check fails to block user‑supplied keys that can overwrite Object.prototype. The flaw gives an attacker the ability to manipulate the global prototype chain, potentially leading to authentication bypass, denial of service, and remote code execution in any application that consumes attacker‑controlled input through this library.

The affected software is the Swiper library from nolimits4web, deployed in Node.js and Bun environments on Windows and Linux. Versions between 6.5.1 and 12.1.1 are vulnerable; the fix is released in version 12.1.2.

With a CVSS score of 9.4 the vulnerability is considered critical. Although the EPSS score is under 1% indicating a low overall risk of discovery, the impact is severe, and the flaw is not listed in the CISA KEV catalog. An attacker who can supply crafted input to a Swiper‑dependent application can pollute Object.prototype and achieve remote code execution; the attack vector relies on application exposure to untrusted data rather than network‑level exploitation.