CVE-2026-92779

Builder.io Gen2 SDKs (through versions 5.2.11 and 0.25.13 ) contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. An attacker with low privileges can craft content blocks whose binding keys contain __proto__, prototyp...

CVE-2026-92779: Improperly Controlled Modification of Object Prototype Attributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...