CVE-2026-92781 PUBLISHED

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Assigner: VulnCheck
Reserved: 16.09.2026 Published: 16.09.2026 Updated: 16.09.2026

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor BuilderIO
Product @builder.io/sdk-react
Versions Default: unaffected
  • affected from 0 to 5.2.11 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-vue
Versions Default: unaffected
  • affected from 0 to 5.2.11 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-svelte
Versions Default: unaffected
  • affected from 0 to 5.2.11 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-solid
Versions Default: unaffected
  • affected from 0 to 5.2.11 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-qwik
Versions Default: unaffected
  • affected from 0 to 0.25.13 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-angular
Versions Default: unaffected
  • affected from 0 to 0.25.13 (incl.)
Vendor BuilderIO
Product @builder.io/sdk-react-nextjs
Versions Default: unaffected
  • affected from 0 to 0.25.13 (incl.)

Credits

  • George Chen finder

References

Problem Types

  • Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') CWE