Prototype Pollution in Builder.io Gen2 SDKs

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability residing within the deep-set helper function. The vulnerability arises from the failure to properly validate content block bindings before processing. An attacker can craft malicious content blocks that include specific keys such as proto, prototype, or constructor. When these blocks are rendered by the application, the vulnerable deep-set function inadvertently merges these keys into the global Object.prototype. Because this pollutes the prototype of all objects within the JavaScript runtime process, it can influence the behavior of unrelated objects, potentially leading to cross-tenant data corruption or systemic logic disruption within the rendering engine. This vulnerability is particularly critical for multi-tenant environments where shared instances may process untrusted content from multiple users.

Impact

Successful exploitation allows for the modification of object behavior application-wide. In multi-tenant environments, this could lead to cross-tenant information disclosure or cross-site scripting by altering the properties of objects relied upon by other users or administrative components. The severity is high due to the potential for impacting subsequent renders and affecting the core execution logic of the application process.

Recommendation

Prioritized actions for engineering and security teams:

• Update Builder.io Gen2 SDKs to versions 5.2.12 and 0.25.14 or later to address the vulnerable deep-set helper function.
• Audit applications using the SDK for any custom deep-merging or property-setting logic that might mirror the vulnerability in CVE-2026-92779.
• In multi-tenant environments, ensure proper sandboxing or process isolation between different content block rendering tasks to minimize the blast radius of prototype pollution.