CVE-2021-23433

Prototype Pollution

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

Affected

algoliasearch-helper

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.63% chance of exploitation in the next 30 days, 76th percentile

Published

2021-11-19

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421

Security advisories

• algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd
• advisories/GHSA-vpf5-82c8-9v36

References

• CVE Record
• NVD entry