Veille CVE

Semaine du 14 septembre au 20 septembre 2026

4 CVE

Critique 0 Élevée 1 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « angular » ✕
  1. CVE-2026-92781 6.3 Moyenne

    BuilderIO @builder.io/sdk-react · BuilderIO @builder.io/sdk-vue · BuilderIO @builder.io/sdk-svelte · BuilderIO @builder.io/sdk-solid

    Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.

  2. CVE-2026-92779 7.6 Élevée

    BuilderIO @builder.io/sdk-react · BuilderIO @builder.io/sdk-vue · BuilderIO @builder.io/sdk-svelte · BuilderIO @builder.io/sdk-solid

    Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

  3. CVE-2026-92214 3.5 Faible

    a2ui-project a2ui

    A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote.

  4. CVE-2026-92213 5.5 Moyenne

    a2ui-project a2ui

    A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.