Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.

This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).

**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00041.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a cve-icon cve-icon
https://github.com/algolia/algoliasearch-helper-js/issues/922 cve-icon cve-icon
https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396 cve-icon cve-icon
History

Sat, 27 Sep 2025 05:15:00 +0000

Type Values Removed Values Added
Description Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.
Weaknesses CWE-1321
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published:

Updated: 2025-09-27T05:00:07.140Z

Reserved: 2025-04-03T10:26:27.920Z

Link: CVE-2025-3193

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2025-09-27T05:15:30.253

Modified: 2025-09-27T05:15:30.253

Link: CVE-2025-3193

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.