Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
@builder.io/sdk-react
Vendor
BuilderIO
Product
@builder.io/sdk-react
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-react · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-vue
Vendor
BuilderIO
Product
@builder.io/sdk-vue
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-vue · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-svelte
Vendor
BuilderIO
Product
@builder.io/sdk-svelte
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-svelte · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-solid
Vendor
BuilderIO
Product
@builder.io/sdk-solid
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-solid · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-qwik
Vendor
BuilderIO
Product
@builder.io/sdk-qwik
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-qwik · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
0.25.13
None listed
@builder.io/sdk-angular
Vendor
BuilderIO
Product
@builder.io/sdk-angular
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-angular · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
0.25.13
None listed
@builder.io/sdk-react-nextjs
Vendor
BuilderIO
Product
@builder.io/sdk-react-nextjs
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-react-nextjs · Scoped product and version facts