CVE-2026-92781: Builder.io Gen2 SDK XSS Vulnerability

CVE-2026-92781 Overview

CVE-2026-92781 is a prototype pollution vulnerability in Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13. The flaw resides in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers craft preview links containing __proto__ or prototype segments. When the SDK processes the malicious URL in a visitor's browser, the payload pollutes Object.prototype, injecting attacker-controlled properties into every object in the JavaScript runtime. The weakness is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.

Critical Impact
A single crafted preview URL can pollute Object.prototype in any visitor's browser, enabling downstream client-side attacks such as logic bypass, cross-site scripting, or denial of service against Builder.io-powered pages.

Affected Products

Builder.io Gen2 SDKs through version 5.2.11
Builder.io Gen2 SDKs through version 0.25.13
Web applications embedding vulnerable Builder.io SDK builds

Discovery Timeline

2026-09-16 - CVE-2026-92781 published to the National Vulnerability Database
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-92781

Vulnerability Analysis

The Builder.io Gen2 SDK reconstructs nested userAttributes objects from URL query parameters using an unflatten helper. The helper walks each dotted key segment and assigns values without filtering reserved property names. When a preview link contains keys such as builder.userAttributes.__proto__.polluted, the helper traverses into the shared prototype chain and writes attacker-controlled data onto Object.prototype. Every subsequently instantiated object inherits the injected properties for the lifetime of the browsing session. Consult the VulnCheck advisory on Builder.io Gen2 SDKs and the upstream flatten helper source for the affected logic.

Root Cause

The unflatten routine lacks prototype guards. It does not reject keys equal to __proto__, prototype, or constructor before assigning values, and it does not use Object.create(null) for intermediate containers. This omission allows external input to reach the prototype chain during URL parsing.

Attack Vector

An attacker distributes a crafted Builder.io preview URL through phishing, chat, or embedded links. When a visitor loads a page that initializes the vulnerable SDK, the client-side parser processes builder.userAttributes segments and mutates Object.prototype. Exploitation requires user interaction to visit the link, but no authentication. The impact is scoped to the victim's browser session on affected pages, per the Builder.io content URL generator.

// Conceptual illustration - no verified PoC code available
// Malicious preview URL pattern:
// https://example.com/page?builder.userAttributes.__proto__.isAdmin=true
// After SDK unflatten() executes, ({}).isAdmin === true in the victim's runtime

Detection Methods for CVE-2026-92781

Indicators of Compromise

Inbound requests containing builder.userAttributes.__proto__ or builder.userAttributes.constructor.prototype in the query string.
Referrer logs showing preview links with encoded variants such as %5F%5Fproto%5F%5F targeting Builder.io-rendered routes.
Client-side error telemetry reporting unexpected inherited properties on plain objects after SDK initialization.

Detection Strategies

Instrument the browser runtime with checks that assert Object.getPrototypeOf({}) remains unmodified after SDK bootstrap.
Deploy web application firewall (WAF) rules that flag query parameters containing __proto__, prototype, or constructor segments.
Scan installed dependency manifests for @builder.io Gen2 SDK versions at or below 5.2.11 and 0.25.13.

Monitoring Recommendations

Forward CDN and reverse proxy access logs to a centralized data lake and alert on suspicious builder.userAttributes patterns.
Track client-side exceptions and content security policy (CSP) violations that correlate with preview link traffic.
Review Builder.io GitHub issue #4824 for upstream patch discussion and additional detection guidance.

How to Mitigate CVE-2026-92781

Immediate Actions Required

Upgrade the Builder.io Gen2 SDK to a version above 5.2.11 or 0.25.13 once a fixed release is available from the BuilderIO repository.
Audit application code for direct use of the vulnerable unflatten helper and replace it with a prototype-safe parser.
Block or sanitize inbound query parameters containing __proto__, prototype, or constructor at the edge.

Patch Information

Refer to the BuilderIO GitHub repository and issue #4824 for the current fix status and release notes. Pin the SDK to a patched version in package.json and rebuild all downstream bundles before redeployment.

Workarounds

Freeze Object.prototype early in application bootstrap using Object.freeze(Object.prototype) to prevent runtime mutation.
Strip or reject query parameters containing reserved prototype keys at the CDN, reverse proxy, or edge worker layer.
Disable Builder.io preview mode in production environments until the SDK is upgraded.

bash

# Example edge rule to drop requests with prototype-pollution query keys
if ($args ~* "(__proto__|constructor\.prototype|(^|&)prototype=)") {
    return 400;
}