CVE-2026-92779: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Builder.io Gen2 SDKsto a version that resolves this vulnerability.Fixed in 5.2.11Patch Prototype Pollution via Bindings - Upgrade
Upgrade
Builder.io Gen2 SDKsto a version that resolves this vulnerability.Fixed in 0.25.13Patch Prototype Pollution via Bindings
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the affected Builder.io Gen2 SDK versions are exposed when they render content blocks whose bindings are processed by the vulnerable deep-set helper. The impact can extend beyond one render because pollution of Object.prototype affects subsequently created objects in the same process, including renders for other tenants.
What does an attacker need to exploit it?
An attacker needs to craft a content block containing binding keys with __proto__, prototype, or constructor paths. The provided data does not state any additional user interaction requirement.
How can teams determine whether they may be affected?
Check whether the application uses Builder.io Gen2 SDKs at or below the versions identified as affected, and whether it renders content block bindings. Review rendered or accepted content blocks for binding keys containing __proto__, prototype, or constructor path segments.