CVE-2021-23433

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada algoliasearch-helper. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

Rincian

Terbit di NVD

19 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421 exploit · advisory pihak ketiga
• https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291 broken link