https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T04:12:27.812593+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349542 EUVD-2026-349542 2026-10-09T04:12:27.871951+00:00 EUVD-2026-349542 https://cve.radiocsirt.org/vuln/fkie_cve-2025-3193 fkie_cve-2025-3193 2026-10-09T04:12:27.871996+00:00

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.

 https://cve.radiocsirt.org/vuln/ghsa-529q-4j3p-7c5r GHSA-529q-4j3p-7c5r — algoliasearch-helper is vulnerable to Prototype Pollution in _merge() 2026-10-09T04:12:27.872052+00:00

Affected: npm: algoliasearch-helper

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.

This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).

**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.