CVE-2026-92779
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/09/2026
Última modificación:
24/09/2026
Descripción
*** Pendiente de traducción *** Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Impacto
Puntuación base 4.0
7.20
Gravedad 4.0
ALTA
Puntuación base 3.x
7.60
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/BuilderIO/builder
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93
- https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26
- https://github.com/BuilderIO/builder/issues/4823
- https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings