Prototype Pollution

2021-11-2410:00:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

algoliasearch-helper

prototype pollution

vulnerability

search patterns

attackers

EPSS

0.003

Percentile

71.5%

JSON

algoliasearch-helper is vulnerable to prototype pollution. The _merge function fails to validate the Object key values when users are able to define arbitrary search patterns, allowing attackers to perform prototype pollution attacks by modifying attributes such as __proto__.