CVE-2021-23433

Prototype Pollution

State: Published
Severity: 5.9 Medium
Published: Nov 19, 2021
Updated: Sep 16, 2024
Reserved: Jan 8, 2021

Description

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
algoliasearch-helpern/a	before 3.6.2Affected

References

https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421
https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291
https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.