CVE-2026-92779 Details
Description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
A prototype pollution vulnerability has been identified in Builder.io Gen2 SDKs, specifically in the deep-set helper function that handles content block bindings. This vulnerability exists in SDK versions through 5.2.11 and 0.25.13. The issue arises because the deep-set function processes binding keys without proper validation, allowing attackers to craft content blocks that include keys targeting the prototype. As a result, Object.prototype can be polluted during the rendering process, impacting all subsequent objects created, including those belonging to other tenants.
Users are advised to update to Builder.io Gen2 SDK versions 5.2.14 or 0.25.14, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BuilderIO/builder | [email protected] | Vendor |
| https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93 | [email protected] | Source CodeVendor |
| https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26 | [email protected] | Source CodeVendor |
| https://github.com/BuilderIO/builder/issues/4823 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Builder.io Gen2 SDK | <= 5.2.11 (semver) |
CPE
Remediation
| |
| Builder.io SDK React | <= 5.2.11 (semver) |
CPE
Remediation
| |
| Builder.io SDK Vue | <= 5.2.11 (semver) |
CPE
Remediation
| |
| Builder.io SDK Svelte | <= 5.2.11 (semver) |
CPE
Remediation
| |
| Builder.io SDK Solid | <= 5.2.11 (semver) |
CPE
Remediation
| |
| Builder.io SDK Qwik | <= 0.25.13 (semver) |
CPE
Remediation
| |
| Builder.io SDK Angular | <= 0.25.13 (semver) |
CPE
Remediation
| |
| Builder.io SDK React Nextjs | <= 0.25.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |