CVE-2026-92779

40th percentile - higher than 40% of all known CVEs

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Prototype pollution can affect all objects in the process, including other tenants' data, leading to unpredictable behavior, privilege escalation, or code execution. This poses a serious threat to the integrity and security of multi-tenant applications.

Upgrade Builder.io Gen2 SDK to a version newer than 5.2.11 and 0.25.13, and implement validation of binding keys in the deep-set function, blocking __proto__, prototype, and constructor paths.