CVE-2026-92781: Builderio @builder.io/sdk-Angular

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

Affected products

• Builderio @builder.io/sdk-Angular: up to and including 0.25.13
• Builderio @builder.io/sdk-Qwik: up to and including 0.25.13
• Builderio @builder.io/sdk-React: up to and including 5.2.11
• Builderio @builder.io/sdk-React-Nextjs: up to and including 0.25.13
• Builderio @builder.io/sdk-Solid: up to and including 5.2.11
• Builderio @builder.io/sdk-Svelte: up to and including 5.2.11
• Builderio @builder.io/sdk-Vue: up to and including 5.2.11

Published 2026-09-16. Last modified 2026-09-24.