Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92779Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

High 7.6

In plain English

A high-severity prototype pollution in @builder.io/sdk-angular from BuilderIO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Affected products (as reported)

Vendor	Product	Versions
BuilderIO	@builder.io/sdk-react	0 – through 5.2.11
BuilderIO	@builder.io/sdk-vue	0 – through 5.2.11
BuilderIO	@builder.io/sdk-svelte	0 – through 5.2.11
BuilderIO	@builder.io/sdk-solid	0 – through 5.2.11
BuilderIO	@builder.io/sdk-qwik	0 – through 0.25.13
BuilderIO	@builder.io/sdk-angular	0 – through 0.25.13
BuilderIO	@builder.io/sdk-react-nextjs	0 – through 0.25.13

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

GitHub Issue #4823 issue-tracking
https://github.com/BuilderIO/builder product
binding keys from content JSON are used as the write path technical-description
the deep-set helper has no __proto__ guard technical-description
VulnCheck Advisory: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings third-party-advisory