CVE-2026-92781
Description
A flaw was found in Builder.io Gen2 SDKs. This prototype pollution vulnerability exists in the unflatten helper, which processes builder.userAttributes query parameters without proper safeguards. A remote attacker could craft malicious preview links containing __proto__ or prototype segments. When a visitor's browser processes these links, it could lead to the manipulation of web application behavior or, in some cases, client-side code execution.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires user interaction to navigate to a crafted preview URL, confining the potential damage to client-side browser execution rather than compromising host or server infrastructure. Red Hat Enterprise Linux and core container platforms do not bundle or ship the Builder.io Gen2 SDK. Consequently, typical Red Hat platform deployments are not directly exposed to this flaw under default configurations.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
