CVE-2026-78180

Name of the Vulnerable Software and Affected Versions alibaba-fusion next versions prior to 1.27.35

Description A prototype pollution flaw exists in the deepMerge component within the components/dialog/index.tsx file. This occurs when the ConfigProvider.getContextProps() function improperly handles the locale argument, allowing a remote attacker to modify object prototype attributes.

Recommendations Update alibaba-fusion next to version 1.27.35 or later. As a temporary mitigation, restrict or validate the input passed to the locale argument in the ConfigProvider.getContextProps() function.