CVE-2025-3193 algoliasearch-helper is vulnerable to Prototype Pollution in _merge()
Prototype pollution in algoliasearch-helper allows code execution via search parameters if errors are caught, requiring non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3193?
CVE-2025-3193 is a high-severity code injection vulnerability in algoliasearch-helper, published on 27 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.
Weakness: CWE-1321
Which versions are affected by CVE-2025-3193?
2 open source packages ship an affected version, including algoliasearch-helper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
algoliasearch-helper npm | From 2.0.0-rc1 | 3.11.2 |
algoliasearch-helper npm | From 2.0.0-rc1 | 3.11.2 |
Products include Algolia Algoliasearch-Helper.
How do I fix CVE-2025-3193?
Upgrade algoliasearch-helper to 3.11.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-3193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3193 exists.
Other vulnerabilities in algoliasearch-helper
Sources
Also known as GHSA-529q-4j3p-7c5r.