rootpwn

high · CVSS v3 7.6 · CVSS v4 7.2

CVE-2026-92779

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability within their deep-set helper function.

Overview

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability within their deep-set helper function. Unvalidated processing of content block bindings allows keys containing prototype properties to modify Object.prototype during rendering. This global state alteration affects subsequent object creations and operations across the host process, including multi-tenant rendering tasks.

Description

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Impact

Applications using vulnerable Builder.io SDKs are subject to global prototype modification. This impacts application integrity, availability, and multi-tenant isolation, potentially allowing cross-tenant state corruption or unexpected application behavior in shared runtime environments.

Remediation

Update Builder.io Gen2 SDK dependencies to versions newer than 5.2.11 and 0.25.13. Ensure content inputs and bindings undergo strict property name validation, and consider running rendering processes in isolated execution contexts.

Risk context

Evaluated with a CVSS v3 score of 7.6 (High) and CVSS v4 score of 7.2. Prompt remediation is advised due to the potential impact of prototype pollution on shared process logic and tenant isolation.

Affected products

  • Builder.io Gen2 SDK <= 5.2.11
  • Builder.io Gen2 SDK <= 0.25.13

Scores

Severity
high
CVSS v2
8
CVSS v3
7.6
CVSS v4
7.2
EPSS
—

cve-2026-92779 prototype-pollution builder-io javascript sdk multi-tenant

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis