CVE-2026-92779: Builderio @builder.io/sdk-Angular

High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days.

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

Affected products

• Builderio @builder.io/sdk-Angular: up to and including 0.25.13
• Builderio @builder.io/sdk-Qwik: up to and including 0.25.13
• Builderio @builder.io/sdk-React: up to and including 5.2.11
• Builderio @builder.io/sdk-React-Nextjs: up to and including 0.25.13
• Builderio @builder.io/sdk-Solid: up to and including 5.2.11
• Builderio @builder.io/sdk-Svelte: up to and including 5.2.11
• Builderio @builder.io/sdk-Vue: up to and including 5.2.11

Published 2026-09-16. Last modified 2026-09-24.