@4c/docusaurus-preset (>=0.2.4 <=0.3.2), @acornellier/react-instantsearch-core (>=6.10.3 <=6.10.3-1) +339 more potentially affected by CVE-2021-23433 via algoliasearch-helper (>=0.0.0-27095c0 <=3.29.1)

algoliasearch-helper NPM version =0.0.0-27095c0, =0.2.4, =6.10.3, =6.10.3-1, =0.1.0, =6.26.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0-beta.1, =1.0.0-beta.9 and more Source cves: CVE-2021-23433 Source advisory: OSV:GHSA-VPF5-82C8-9V36...

CVE-2021-23433 Prototype Pollution

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

CVE-2021-23433

CVE-2021-23433 affects the JavaScript package algoliasearch-helper, specifically versions before 3.6.2. The vulnerability arises from a Prototype Pollution risk in the merge path used by SearchParameters (src/SearchParameters/index.js) via the merge function in _parseNumbers, with no protection a...