Description
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties.
Recommendation
Update the algoliasearch-helper package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.6.2
- Patched version(s): 3.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in algoliasearch-helper and gives you actionable findings to investigate.
Start a free scanRelated Issues
- algoliasearch-helper is vulnerable to Prototype Pollution in _merge() - CVE-2025-3193
- Prototype Pollution in the merge and clone helper methods - CVE-2021-39227
- Prototype pollution in min-dash - CVE-2021-23460
- json-schema is vulnerable to Prototype Pollution - CVE-2021-3918
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023