Description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BuilderIO | @builder.io/sdk-react | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-vue | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-svelte | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-solid | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-qwik | ≤ 0.25.13 | — |
| BuilderIO | @builder.io/sdk-angular | ≤ 0.25.13 | — |
| BuilderIO | @builder.io/sdk-react-nextjs | ≤ 0.25.13 | — |
References
- GitHub Issue #4823 issue-tracking
- https://github.com/BuilderIO/builder product
- binding keys from content JSON are used as the write path technical-description
- the deep-set helper has no __proto__ guard technical-description
- VulnCheck Advisory: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings third-party-advisory