Threats tagged 'ghsa-4qmr-g3pc-xvhm'

CVE-2026-92779 is a prototype pollution vulnerability in BuilderIO's @builder.io/sdk-react Gen2 SDKs up to versions 5.2.11 and 0.25.13. The flaw exists in the deep-set helper function that processes content block bindings without proper validation, allowing attackers to manipulate Object.prototype during rendering. This affects all objects created subsequently, including those related to other tenants' renders.