en
Builder.io is a software company focused on visual development, headless content management, and AI-assisted design-to-code workflows. Its API-first platform lets teams create, manage, optimize, and deliver web and mobile experiences using visual editing, structured content, existing code components, and framework SDKs. It is intended for product, engineering, design, marketing, and enterprise teams.
As of 10/21/2026, BuilderIO recorded 3 security vulnerabilities in the last 90 days across 8 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, @builder.io/sdk-angular had the most security vulnerabilities in the BuilderIO ecosystem, with 2 vulnerabilities—approximately 66.67% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-92781Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributesCVE-2026-92779Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via BindingsCVE-2026-82286gpt-crawler Arbitrary File Write via outputFileName ParameterCVE-2023-2307Cross-Site Request Forgery (CSRF) in builderio/qwikCVE-2023-1283Code Injection in builderio/qwik| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-92781Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes | Exploitation statusActively exploited | FixYes | Affected product@builder.io/sdk-react | Published09/16/2026 | SeverityMedium |
CVE-2026-92779Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings | Exploitation statusNot exploited | FixYes | Affected product@builder.io/sdk-react | Published | |
CVE-2026-82286gpt-crawler Arbitrary File Write via outputFileName Parameter | Exploitation statusActively exploited | FixYes | Affected productgpt-crawler | Published08/28/2026 | |
CVE-2023-2307Cross-Site Request Forgery (CSRF) in builderio/qwik | Exploitation statusActively exploited | FixYes | Affected productbuilderio/qwik | Published04/26/2023 | |
CVE-2023-1283Code Injection in builderio/qwik | Exploitation statusActively exploited | FixYes | Affected productbuilderio/qwik | Published03/08/2023 | |
CVE-2023-0410Cross-site Scripting (XSS) - Generic in builderio/qwik | Exploitation statusActively exploited | FixYes | Affected productbuilderio/qwik | Published01/20/2023 |
6 Results | Page 1 of 1
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |