CVE-2025-3193 describes a prototype pollution vulnerability in the algoliasearch-helper package affecting versions from 2.0.0-rc1 up to but not including 3.11.2. The vulnerability arises in the _merge() function within merge.js, where constructor.prototype can be overwritten despite an error being thrown. In rare cases where the error is caught, this can lead to execution of code injected via user-supplied search parameters. This issue is related but distinct from CVE-2021-23433. The default configuration of InstantSearch is not vulnerable as it does not allow user modification of searchParameters.

The vulnerability allows prototype pollution which can lead to arbitrary code execution if the error thrown by writing constructor.prototype is caught and the injected code is executed. However, in the default InstantSearch configuration, this attack vector is not exploitable because user input cannot modify searchParameters. There are no known exploits in the wild at this time.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if they are using affected versions (2.0.0-rc1 and versions before 3.11.2) and consider upgrading to a fixed version once available. Additionally, ensure that user input cannot modify searchParameters or that error handling does not allow execution of injected code.