Good question. I provide two points of view:
a) According to the scientific community, anything not peer-reviewed is non-verified. Thus, you could reject the paper because it builds on non-verified sources. Building on non-verified (=non peer-reviewed) claims violates "the code of conduct" for research. In computer science, this "code of conduct" is not even known to everyone, but in other disciplines even conference papers are considered as non-properly reviewed and a poor source. The authors should have been aware of this. It is certainly not on you to review two papers, but, in practice, I often end up reading multiple papers for a review, e.g. to assess contributions of a paper or to verify claims of a paper.
b) Many high-quality papers get published on arxiv.org and they are also cited a lot. While arxiv.org does not do any real reviewing, they do a very lightweight check of publications (e.g. is it copy&paste from somewhere else...) and they ensure that only members of reputable institutions can publish there. The average quality of an arxiv.org paper is arguably at least the level of a lower quality conference or journal. Furthermore, many reviewers only conduct "coarse" sanity checks. My guess is that less than 50% of issues in technical details (proofs) are caught by reviews. So, building upon an arxiv.org paper is arguably as good as using other sources.
What is the recommendation?
If it is a high profile conference/journal and the paper's claims require the non-peer reviewed source to be correct, you should probably reject it.
If you want to play it safe, reject.
If the claims are non-essential and it is a really good paper, you might give it a chance, you could lower your rating because of this and also state the issue clearly in the review as others suggested.