Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-92779

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

BuilderIO @builder.io/sdk-react

Default version status: unaffected

  • 0 to ≤ 5.2.11affected
pkg:npm/%40builder.io/sdk-react

BuilderIO @builder.io/sdk-vue

Default version status: unaffected

  • 0 to ≤ 5.2.11affected
pkg:npm/%40builder.io/sdk-vue

BuilderIO @builder.io/sdk-svelte

Default version status: unaffected

  • 0 to ≤ 5.2.11affected
pkg:npm/%40builder.io/sdk-svelte

BuilderIO @builder.io/sdk-solid

Default version status: unaffected

  • 0 to ≤ 5.2.11affected
pkg:npm/%40builder.io/sdk-solid

BuilderIO @builder.io/sdk-qwik

Default version status: unaffected

  • 0 to ≤ 0.25.13affected
pkg:npm/%40builder.io/sdk-qwik

BuilderIO @builder.io/sdk-angular

Default version status: unaffected

  • 0 to ≤ 0.25.13affected
pkg:npm/%40builder.io/sdk-angular

BuilderIO @builder.io/sdk-react-nextjs

Default version status: unaffected

  • 0 to ≤ 0.25.13affected
pkg:npm/%40builder.io/sdk-react-nextjs

References