What is GHSA-vpf5-82c8-9v36?

GHSA-vpf5-82c8-9v36 is a security advisory published by GitHub Security Advisories with Critical severity. Prototype Pollution in algoliasearch-helper

Which CVE IDs does GHSA-vpf5-82c8-9v36 cover?

GHSA-vpf5-82c8-9v36 covers the following CVE IDs: CVE-2021-23433. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vpf5-82c8-9v36?

GHSA-vpf5-82c8-9v36 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vpf5-82c8-9v36?

GHSA-vpf5-82c8-9v36 affects 1 product, including: npm/algoliasearch-helper:\u003c 3.6.2.

GHSA-vpf5-82c8-9v36CriticalCVSS 9.8

Prototype Pollution in algoliasearch-helper

Vendor

GitHub Security Advisories

Published

November 23, 2021

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-23433 →

📋 Description

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

🎯 Affected products1

npm/algoliasearch-helper:< 3.6.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23433
https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd
https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291
https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421
https://github.com/advisories/GHSA-vpf5-82c8-9v36