Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
@builder.io/sdk-react
Vendor
BuilderIO
Product
@builder.io/sdk-react
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-react · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-vue
Vendor
BuilderIO
Product
@builder.io/sdk-vue
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-vue · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-svelte
Vendor
BuilderIO
Product
@builder.io/sdk-svelte
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-svelte · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-solid
Vendor
BuilderIO
Product
@builder.io/sdk-solid
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-solid · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
5.2.11
None listed
@builder.io/sdk-qwik
Vendor
BuilderIO
Product
@builder.io/sdk-qwik
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-qwik · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
0.25.13
None listed
@builder.io/sdk-angular
Vendor
BuilderIO
Product
@builder.io/sdk-angular
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-angular · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
0.25.13
None listed
@builder.io/sdk-react-nextjs
Vendor
BuilderIO
Product
@builder.io/sdk-react-nextjs
Platforms
Unknown
Default status
unaffected
@builder.io/sdk-react-nextjs · Scoped product and version facts