CVE-2026-92779
7.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Summary
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| BuilderIO | @builder.io/sdk-react | 0 <= 5.2.11 | affected |
| BuilderIO | @builder.io/sdk-vue | 0 <= 5.2.11 | affected |
| BuilderIO | @builder.io/sdk-svelte | 0 <= 5.2.11 | affected |
| BuilderIO | @builder.io/sdk-solid | 0 <= 5.2.11 | affected |
| BuilderIO | @builder.io/sdk-qwik | 0 <= 0.25.13 | affected |
| BuilderIO | @builder.io/sdk-angular | 0 <= 0.25.13 | affected |
| BuilderIO | @builder.io/sdk-react-nextjs | 0 <= 0.25.13 | affected |
Weaknesses
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://github.com/BuilderIO/builder/issues/4823
- https://github.com/BuilderIO/builder
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26
- https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.