PT-2021-15521 · Unknown · Algoliasearch-Helper

Divyesh Prajapati · Published 2021-11-19 · Updated 2025-10-05 · CVE-2021-23433

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions algoliasearch-helper versions prior to 3.6.2

Description The issue arises from the use of the merge function in src/SearchParameters/index.js, specifically in the SearchParameters. parseNumbers function, without protection against prototype properties, leading to Prototype Pollution. This is only exploitable if the implementation allows users to define arbitrary search patterns.

Recommendations For versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting user input to prevent arbitrary search patterns.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-23433

GHSA-VPF5-82C8-9V36

SNYK-JS-ALGOLIASEARCHHELPER-1570421

Affected Products

Algoliasearch-Helper

References · 12

• 🔥 https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421 · Exploit
• https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23433 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23433 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vpf5-82c8-9v36 · Vendor Advisory
• https://github.com/algolia/algoliasearch-helper-js · Note
• https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291 · Note
• https://t.me/cvenotify/23517 · Telegram Post
• https://t.me/cveNotify/136683 · Telegram Post
• https://t.me/cveNotify/137395 · Telegram Post
• https://t.me/CVEtracker/33524 · Telegram Post
• https://t.me/cibsecurity/32728 · Telegram Post