CVE-2026-92781: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
builder.io Gen2 SDKto a version that resolves this vulnerability.Fixed in 5.2.11 - Upgrade
Upgrade
builder.io Gen2 SDKto a version that resolves this vulnerability.Fixed in 0.25.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Visitors whose browsers load an affected Builder.io Gen2 SDK and process a crafted preview link are exposed. The attack targets client-side Object.prototype pollution rather than requiring access to the application server.
What does an attacker need to exploit it?
An attacker needs to get a visitor to open a crafted preview link containing builder.userAttributes query parameters with __proto__ or prototype segments. No attacker privileges are required, but user interaction is required.
How can I tell whether my deployment is affected?
Deployments using Builder.io Gen2 SDK versions through 5.2.11 or 0.25.13 are affected if they process preview URLs with builder.userAttributes parameters. Inspect generated or received preview links for builder.userAttributes values containing __proto__ or prototype segments.