CVE-2026-92781

MediumCVSS 6.3

Published: 16/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

27th percentile - higher than 27% of all known CVEs

Summary

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

Risk Assessment

Prototype pollution in a visitor's browser can lead to arbitrary JavaScript execution, session theft, or altered application behavior. The risk affects any visitor who opens a crafted link.

Recommendation

Upgrade Builder.io Gen2 SDK beyond versions 5.2.11 and 0.25.13. Deploy a Content Security Policy restricting script execution.

Other vulnerabilities in Builder.io Gen2 SDK

CVE-2026-92779High
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS