CVE-2026-78180
Received Received - Intake

Improper Prototype Pollution in Alibaba Fusion Next

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78180
EUVD
EUVD-2026-64702

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
alibaba-fusion next to 1.27.34 (inc)
alibaba-fusion next 1.27.34
alifd next 1.27.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a prototype pollution vulnerability in the @alifd/next library affecting the ConfigProvider component. The issue occurs in the deepMerge function which fails to validate prototype-related keys like __proto__, constructor, or prototype. Attackers can inject malicious properties into Object.prototype through crafted locale objects, impacting any application using the library.

Detection Guidance

To detect this prototype pollution vulnerability in alibaba-fusion next, inspect applications using @alifd/next version 1.27.34 or earlier. Check for improper handling of locale objects, particularly keys like __proto__, constructor, or prototype in the deepMerge function. Review ConfigProvider.getContextProps() and related APIs for unvalidated input.

Impact Analysis

Exploitation can lead to prototype pollution, denial of service by overwriting Object.prototype.toString, or unintended property inheritance in ordinary objects. Applications using external or user-controlled locale/config sources are particularly at risk as this allows remote initiation of attacks.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling prototype pollution attacks. Such attacks may allow unauthorized modification of application behavior or data integrity, potentially violating principles of data protection and confidentiality required by these regulations.

Mitigation Strategies

Upgrade to a patched version of @alifd/next beyond 1.27.34. Implement input validation to reject prototype-related keys in locale objects. Use safer iteration methods in deepMerge and add regression tests. Avoid using external or user-controlled locale sources without sanitization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart