CVE-2026-92781 in Builder
Summary
by MITRE • 09/16/2026
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Builder.io Gen2 Software Development Kits, specifically versions up through 5.2.11 and 0.25.13, are susceptible to a critical Prototype Pollution vulnerability within their unflatten helper function. This security flaw arises from the SDK's handling of query parameters derived from builder.userAttributes without implementing adequate prototype guards or input validation checks. The core technical issue lies in how the application processes nested objects during data flattening and subsequent reconstruction. When user-supplied input is merged into an existing object structure, the code fails to verify whether property keys correspond to standard object properties or inherited ones like _proto_. This lack of sanitization allows attackers to inject malicious payloads directly into the JavaScript Object prototype chain by manipulating URL query strings that are processed as part of the preview link generation mechanism.
From a technical perspective, this vulnerability is classified under CWE-1321: Prototype Pollution and aligns with MITRE ATT&CK technique T1505.003, which involves Server-Side JavaScript Injection or similar client-side injection vectors depending on the execution context. The unflatten utility typically iterates over key-value pairs to reconstruct complex object hierarchies from flat strings. If a developer does not explicitly check for _proto_, constructor, or prototype keys before assignment, these special properties are treated as regular data points. Consequently, when an attacker crafts a preview link containing parameters such as ?_proto_[polluted]=true, the SDK merges this into the global Object.prototype rather than a local instance variable. This results in all subsequent object instantiations within that browser session inheriting the polluted property, effectively compromising the integrity of the entire application state for any user who visits the malicious URL.
The operational impact of this vulnerability is significant because it enables remote code execution scenarios or severe data manipulation without requiring authentication if the preview functionality is publicly accessible. By polluting Object.prototype, an attacker can alter default behaviors across the application, potentially bypassing security checks, stealing sensitive information stored in objects, or causing denial of service by breaking critical logic that relies on standard object methods like hasOwnProperty or toString. Since this occurs client-side via browser execution, it affects all visitors who interact with the compromised preview links, leading to widespread compromise of user sessions and data integrity within the scope of the affected SDK version.
To mitigate this risk, organizations must immediately upgrade their Builder.io Gen2 SDKs to versions 5.2.12 or later where prototype pollution guards have been implemented in the unflatten helper function. These updates typically include checks that prevent assignment to _proto_ and other dangerous keys during object merging processes. Additionally, developers should implement strict input validation on all user-supplied data before it is processed by any utility functions that manipulate object structures. Utilizing libraries or methods that explicitly isolate prototype chains, such as Object.create(null) for new objects, can further reduce the attack surface. Regular security audits and static code analysis focused on dynamic property assignment patterns are recommended to ensure no similar vulnerabilities exist in custom implementations of data processing logic within the application ecosystem.