PT-2025-39711 · Unknown · Algoliasearch-Helper

Peng Zhou + 1 · Published 2025-09-27 · Updated 2025-10-05 · CVE-2025-3193

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions algoliasearch-helper versions 2.0.0-rc1 through 3.11.2

Description The package contains a Prototype Pollution issue in the merge() function within the merge.js file. This allows modification of the constructor.prototype, potentially leading to code execution if errors are caught and user-supplied search parameters are injected. This is a distinct issue from another reported problem. The vulnerability is not exploitable in the default configuration of InstantSearch because search parameters are not user-modifiable.

Recommendations Update to a version after 3.11.2.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-3193

GHSA-529Q-4J3P-7C5R

Affected Products

Algoliasearch-Helper

References · 11

• 🔥 https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396 · Exploit
• https://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a · Patch
• https://github.com/algolia/algoliasearch-helper-js/issues/922 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-3193 · Security Note
• https://osv.dev/vulnerability/GHSA-529q-4j3p-7c5r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3193 · Vendor Advisory
• https://github.com/algolia/algoliasearch-helper-js · Note
• https://t.me/cveNotify/136683 · Telegram Post
• https://t.me/CVEtracker/33524 · Telegram Post
• https://t.me/cveNotify/137395 · Telegram Post
• https://twitter.com/CVEnew/status/1971805696602554581 · Twitter Post