GCVE - cpe:2.3:a:builderio:@builder.io/sdk-qwik:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:builderio:@builder.io/sdk-qwik:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Builderio (`6fbc9644-d8d5-537e-b9f4-6e4bcface830`)
Product	@Builder.Io/Sdk Qwik (`8ec31f84-7d7f-5a2c-80a9-2c854351555d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92781`	vulnerable	2026-10-13 12:28:53.538774	Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes MEDIUM (6.3) Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL. Published: 2026-09-16T20:32:38.923Z Updated: 2026-09-21T15:50:13.299Z Open on db.gcve.eu Reference links https://github.com/BuilderIO/builder/issues/4824 https://github.com/BuilderIO/builder https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-content/generate-content-url.ts https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/helpers/flatten.ts#L60-L76 https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-builder-userattributes	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-92779`	vulnerable	2026-10-13 12:28:53.400384	Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings HIGH (7.6) Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders. Published: 2026-09-16T20:32:37.544Z Updated: 2026-09-17T19:25:04.694Z Open on db.gcve.eu Reference links https://github.com/BuilderIO/builder/issues/4823 https://github.com/BuilderIO/builder https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93 https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26 https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

@Builder.Io/Sdk Qwik

Notes

PURL mappings

Vulnerability references

Contribute