Executive brief
Builder.io's Gen2 SDKs are visual development tools used to build web interfaces for React, Vue, Svelte, and other frameworks. A prototype pollution vulnerability in the SDK's URL parameter processing allows attackers to craft malicious preview links that corrupt the JavaScript Object.prototype in visitors' browsers, potentially leading to application malfunction or behavior hijacking on affected pages.
Technical details
The vulnerability is a prototype pollution flaw in the unflatten helper function, which processes builder.userAttributes query parameters without proper prototype guards. Attackers can craft URLs containing __proto__ or prototype segments that, when processed by the SDK running in a visitor's browser, pollute Object.prototype and alter the behavior of JavaScript objects across the application. The attack vector is network-based and requires no authentication; victims need only visit a malicious link. An attacker can modify global object behavior, potentially causing denial of service, application logic hijacking, or information disclosure depending on how the affected application uses prototypes.
Affected products
- Builder.io Gen2 SDKs through 5.2.11 and 0.25.13
Timeline
- 2026-09-16: disclosed