CVE-2021-23433 Prototype Pollution
Prototype pollution in algoliasearch-helper allows attackers to modify object prototypes if arbitrary search patterns are permitted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23433?
CVE-2021-23433 is a medium-severity vulnerability in algoliasearch-helper, published on 19 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
Weakness: CWE-1321
Which versions are affected by CVE-2021-23433?
2 open source packages ship an affected version, including algoliasearch-helper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
algoliasearch-helper npm | All versions | 3.6.2 |
algoliasearch-helper npm | All versions | 3.6.2 |
Products include Algolia Algoliasearch-Helper.
How do I fix CVE-2021-23433?
Upgrade algoliasearch-helper to 3.6.2 or later.
Is CVE-2021-23433 being exploited?
There is no known exploitation of CVE-2021-23433 in the wild and no public exploit code.
Other vulnerabilities in algoliasearch-helper
Sources
Also known as GHSA-vpf5-82c8-9v36, SNYK-JS-ALGOLIASEARCHHELPER-1570421.