CVE-2021-23433
CVE-2021-23433 · Prototype Pollution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
CVSS 5.9 · Medium · EPSS 1.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
algoliasearch-helper
- Versions
- ≥ unspecified, < 3.6.2: Affected (custom)
Update to 3.6.2
algoliasearch-helper npm
- Affected ranges
- SEMVER: < 3.6.2
Update to 3.6.2