CVE-2025-3193
Description
Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.
How to fix
- algolia algoliasearch-helper3.11.2 or later
- algoliasearch-helper3.11.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| algolia algoliasearch-helper | 2.0.0 ≤ v < 3.11.2 | 3.11.2 |
| algoliasearch-helpernpm | 2.0.0-rc1 ≤ v < 3.11.2 | 3.11.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.