AIKIDO-2025-10318

TL;DR

Affected versions of this package do not support the TrustedTypes API, which is designed to prevent DOM-based injection attacks such as Cross-Site Scripting (XSS). When used in environments enforcing TrustedTypes, Swiper.js fails to wrap dynamic HTML assignments with innerHTML. An attacker could exploit this by injecting malicious payloads into Swiper-controlled elements (e.g., slides, pagination, or navigation) if the application passes unsanitized user input to Swiper's initialization or content methods, effectively bypassing protections and enabling XSS attacks.