{"id":"EUVD-2025-31407","enisaUuid":"7821fff9-fab2-3236-8304-19f195889766","description":"Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the \"extreme edge-case\" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.\r\rThis is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).\r\r**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.","datePublished":"Sep 27, 2025, 5:00:07 AM","dateUpdated":"Aug 8, 2026, 3:25:22 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396\nhttps://github.com/algolia/algoliasearch-helper-js/issues/922\nhttps://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a\n","aliases":"CVE-2025-3193\nGHSA-529q-4j3p-7c5r\n","assigner":"snyk","epss":0.52,"enisaIdProduct":[{"id":"c4a50e09-d58f-34ca-9ed3-612b05b67cc5","product":{"name":"algoliasearch-helper","vendor":{"name":"n/a"}},"product_version":"2.0.0-rc1 \u003c3.11.2"}],"enisaIdVendor":[{"id":"264c6f52-077a-3459-8c35-7272cdeb2299","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"a856c3da-50be-395d-a4b9-a8ba6b32ea2a","vulnerability":{"id":"GHSA-529q-4j3p-7c5r","description":"algoliasearch-helper is vulnerable to Prototype Pollution in _merge()","datePublished":"Sep 27, 2025, 6:30:52 AM","dateUpdated":"Sep 30, 2025, 8:54:39 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-3193\nhttps://github.com/algolia/algoliasearch-helper-js/issues/922\nhttps://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a\nhttps://github.com/algolia/algoliasearch-helper-js\nhttps://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396\n","enisa_id":"EUVD-2025-31407\n","aliases":"CVE-2025-3193\nGHSA-529q-4j3p-7c5r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b5ba661d-0c91-312e-b261-dbcffb329e63","vulnerability":{"id":"CVE-2025-3193","description":"Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the \"extreme edge-case\" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.\r\rThis is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).\r\r**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.","datePublished":"Sep 27, 2025, 5:00:07 AM","dateUpdated":"Aug 8, 2026, 3:25:22 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396\nhttps://github.com/algolia/algoliasearch-helper-js/issues/922\nhttps://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a\n","enisa_id":"EUVD-2025-31407\n","assigner":"snyk","epss":0.52,"dataProcessed":"Oct 29, 2026, 7:13:43 AM","vulnerabilityProduct":[{"id":"16092b82-5e50-33e1-bd4c-68445f779ad0","product":{"name":"algoliasearch-helper","vendor":{"name":"n/a"}},"product_version":"2.0.0-rc1 \u003c3.11.2"}],"vulnerabilityVendor":[{"id":"32e75e8e-51ec-3eed-a389-9b67f4fdd3b0","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}