CVE-2026-78180: alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alibaba-fusion next deepMergeto a version that resolves this vulnerability.Fixed in 1.27.34
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects npm package alibaba-fusion next through version 1.27.34. The vulnerable behavior is in ConfigProvider.getContextProps used by the deepMerge component logic in components/dialog/index.tsx.
What does an attacker need to exploit this issue?
An attacker needs to be able to remotely manipulate the locale argument passed to the affected function. No privileges or user interaction are indicated by the supplied severity vector.
What is the impact of successful exploitation?
Successful exploitation can improperly modify object prototype attributes. The supplied severity vector indicates potential low-impact effects on confidentiality, integrity, and availability.