https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 06:31:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349542 EUVD-2026-349542 https://cve.radiocsirt.org/vuln/euvd-2026-349542 https://cve.radiocsirt.org/vuln/fkie_cve-2025-3193 <p>Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the &#34;extreme edge-case&#34; that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.</p> <p>Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the &#34;extreme edge-case&#34; that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted. This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421). **NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-3193 https://cve.radiocsirt.org/vuln/ghsa-529q-4j3p-7c5r <p><strong>Affected:</strong> npm: algoliasearch-helper</p> <p>Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the &#34;extreme edge-case&#34; that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.</p> <p>This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).</p> <p>**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.</p> <p><strong>Affected:</strong> npm: algoliasearch-helper</p> <p>Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the &#34;extreme edge-case&#34; that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.</p> <p>This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).</p> <p>**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.</p> https://cve.radiocsirt.org/vuln/ghsa-529q-4j3p-7c5r