BuilderIO Gen2 SDKs for React up to versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper function. This function processes builder.userAttributes query parameters but lacks safeguards against prototype pollution attacks. An attacker can exploit this by crafting preview URLs containing __proto__ or prototype keys, causing pollution of the Object.prototype in the browser environment of users who load the malicious URL. This can lead to unexpected behavior or security issues in client-side code relying on object prototypes.

Successful exploitation allows an attacker to modify the Object.prototype in a visitor's browser, potentially leading to client-side security issues such as altered application logic or data manipulation. The vulnerability requires user interaction (clicking a crafted preview link) and has low attack complexity with no privileges or authentication required. The impact on confidentiality, integrity, and availability is low to limited according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted preview links containing userAttributes query parameters or sanitize inputs to prevent prototype pollution. Monitor vendor communications for updates and patches addressing this vulnerability.