Skip to main content

Builder.io Gen2 SDKs CVE-2026-92781

| EUVDEUVD-2026-81044 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-09-16 VulnCheck GHSA-mgr8-fxxv-82mj
Information Disclosure Prototype Pollution JavaScript Builder Io Sdk React Builder Io Sdk Vue Builder Io Sdk Svelte Builder Io Sdk Solid Builder Io Sdk Qwik Builder Io Sdk Angular Builder Io Sdk React Nextjs
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Remote unauthenticated crafted link but victim must open it (UI:R); client-side prototype pollution yields low, gadget-dependent C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Metadata Corrected
Sep 16, 2026 - 22:40 vuln.today
tag: JavaScript added
Analysis Generated
Sep 16, 2026 - 22:17 vuln.today

DescriptionCVE.org

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

AnalysisAI

Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid packages at or below 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik at or below 0.25.13) lets unauthenticated remote attackers poison Object.prototype in a victim's browser by luring the victim into opening a crafted preview link whose builder.userAttributes query parameters carry __proto__ or prototype segments. Exploitation is not automatable against a passive server - it hinges on user interaction (UI:P), because the SDK must actually be running in the victim's browser when the malicious URL is processed, and real harm (DOM XSS, client-side logic tampering, denial of service) only materializes if downstream application code reads the polluted inherited properties. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the SDK to process a client-supplied URL carrying builder.userAttributes query parameters - this is the preview/personalization code path in Builder.io Gen2 SDKs at or below 5.2.11 (svelte/vue/react/solid) and 0.25.13 (angular/react-nextjs/qwik). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Moderate-to-low real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade every affected package past its vulnerable ceiling - @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid above 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik above 0.25.13 - while noting that an exact patched release number is not independently confirmed from the available data, so confirm the fixed build against the vendor repository https://github.com/BuilderIO/builder, the tracking issue https://github.com/BuilderIO/builder/issues/4824 and the VulnCheck advisory https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-builder-userattributes before pinning. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Prototype Pollution

View all
CVE-2026-34621 HIGH POC
8.6 Apr 11

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
CVE-2024-56059 CRITICAL
9.8 Dec 18

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
CVE-2020-28271 CRITICAL POC
9.8 Nov 12

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
CVE-2023-38894 CRITICAL POC
9.8 Aug 16

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
CVE-2024-24292 CRITICAL POC
9.8 Mar 28

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
CVE-2023-26121 CRITICAL POC
10.0 Apr 11

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
CVE-2021-23449 CRITICAL POC
10.0 Oct 18

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
CVE-2024-39011 CRITICAL POC
9.8 Jul 30

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
CVE-2024-38988 CRITICAL POC
9.8 Mar 28

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
CVE-2025-57347 CRITICAL POC
9.8 Sep 24

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
CVE-2025-57321 CRITICAL POC
9.8 Sep 24

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
CVE-2024-45435 CRITICAL POC
9.8 Aug 29

Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2024-56059 CRITICAL
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8
CVE-2023-26121 CRITICAL POC
10.0
CVE-2021-23449 CRITICAL POC
10.0
CVE-2024-39011 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-92781 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy