CyberRota Analysis
AI-GeneratedThe Builder.io Gen2 SDKs up to versions 5.2.11 and 0.25.13 are vulnerable to prototype pollution due to inadequate validation in the deep-set helper function, allowing attackers to manipulate Object.prototype. This can lead to unauthorized access or modification of properties in all subsequent objects, potentially impacting multiple tenants' renders. Organizations using these SDKs should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.