rootpwn

high · CVSS v3 6.3 · CVSS v4 5.3

CVE-2026-92781

Builder.io Gen2 SDKs contain a prototype pollution vulnerability within the unflatten helper function when parsing user attributes from URL

Overview

Builder.io Gen2 SDKs contain a prototype pollution vulnerability within the unflatten helper function when parsing user attributes from URL query parameters. When a user opens a specially structured preview link, the vulnerability allows un-guarded modification of Object.prototype within the client-side browser session. Updating the affected SDK dependencies resolves the unsafe parameter processing.

Description

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

Impact

Web applications utilizing affected Builder.io Gen2 SDK versions are vulnerable to client-side prototype pollution. Successful exploitation affects client-side integrity and confidentiality, potentially enabling secondary front-end script manipulations within the user's browser context.

Remediation

Update Builder.io Gen2 SDK dependencies to versions beyond 5.2.11 and 0.25.13 where prototype guards are enforced. Validate and sanitize incoming query parameter objects prior to processing user attributes in custom application code.

Risk context

Assessed with a High severity rating (CVSS v3: 6.3, CVSS v4: 5.3) and no current EPSS score reported. Urgency is moderate to high for front-end application maintainers, as the vector relies on user interaction via malicious URLs.

Affected products

  • Builder.io Gen2 SDK <= 5.2.11
  • Builder.io Gen2 SDK <= 0.25.13

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
—

CVE-2026-92781 Builder.io Prototype Pollution JavaScript Client-Side SDK

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis