CVE-2021-23433 MEDIUM

CVE-2021-23433: Prototype Pollution

Vendor N/A
Product algoliasearch-helper
Published November 19, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

What the vulnerability does

01Description

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

Key dates

02Disclosure timeline

November 19, 2021 CVE published
September 16, 2024 Record updated