Description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BuilderIO | @builder.io/sdk-react | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-vue | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-svelte | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-solid | ≤ 5.2.11 | — |
| BuilderIO | @builder.io/sdk-qwik | ≤ 0.25.13 | — |
| BuilderIO | @builder.io/sdk-angular | ≤ 0.25.13 | — |
| BuilderIO | @builder.io/sdk-react-nextjs | ≤ 0.25.13 | — |
References
- GitHub Issue #4824 issue-tracking
- https://github.com/BuilderIO/builder product
- builder.userAttributes parameters are expanded through unflatten technical-description
- unflatten walks the dotted key path with no prototype guard technical-description
- VulnCheck Advisory: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes third-party-advisory