CVE-2026-92779
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
16/09/2026
Last modified:
24/09/2026
Description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Impact
Base Score 4.0
7.20
Severity 4.0
HIGH
Base Score 3.x
7.60
Severity 3.x
HIGH
References to Advisories, Solutions, and Tools
- https://github.com/BuilderIO/builder
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26
- https://github.com/BuilderIO/builder/issues/4823
- https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings