BuilderIO Gen2 SDKs for @builder.io/sdk-react through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function. This function processes content block bindings without validating keys, allowing attackers to inject keys such as __proto__, prototype, or constructor. This injection modifies the Object.prototype, affecting all objects created during rendering, including those belonging to other tenants. The vulnerability is publicly known and assigned CVE-2026-92779 with a CVSS 4.0 score of 7.2, indicating high severity. No vendor advisory or patch information is available, and the product is not a cloud service, so remediation status is unknown.

Successful exploitation allows an attacker to modify the Object.prototype, which can lead to unexpected behavior or security issues in all objects created during the rendering process. This can affect multiple tenants sharing the rendering environment, potentially leading to cross-tenant impact. The vulnerability is rated high severity with a CVSS score of 7.2, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor BuilderIO's advisories for updates. Until a fix is available, avoid processing untrusted content blocks or apply custom validation to prevent prototype pollution keys in content bindings.