CVE-2026-92781

Name of the Vulnerable Software and Affected Versions Builder.io Gen2 SDKs versions 5.2.11 and 0.25.13

Description A prototype pollution issue exists in the unflatten helper. This occurs when the SDK processes builder.userAttributes query parameters without implementing prototype guards. An attacker can create malicious preview links containing proto or prototype segments, allowing them to pollute Object.prototype in the browser of a visitor who accesses the URL. Prototype pollution is a technique where an attacker manipulates the base object prototype to inject properties into all objects in the JavaScript environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.