Skip to content

Minor upgrade for algoliasearch-helper #39

@thejustinwalsh

Description

@thejustinwalsh

Find more live information in Aikido here: https://app.aikido.dev/queue?sidebarIssue=16045283&groupId=37390&sidebarIssueTask=1283010&sidebarTab=tasks

Scope

This task includes issues in the following code repository:

  • ts-defold.github.io: yarn.lock

TLDR

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

How to fix

We recommend updating from 3.1.1 to 3.6.2.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions