CVE-2026-92781 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
Prototype pollution in Builder.io SDKs allows attackers to pollute Object.prototype via crafted preview links, potentially leading to code execution or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-92781?
CVE-2026-92781 is a medium-severity vulnerability in BuilderIO @builder.io/sdk-angular, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Weakness: CWE-1321
Which versions are affected by CVE-2026-92781?
How do I fix CVE-2026-92781?
No fix has been published for CVE-2026-92781 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92781 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92781 exists.
Sources
Also known as GHSA-mgr8-fxxv-82mj.