alibaba-fusion Next CVE-2026-78180

Exploitation requires that the target application uses alibaba-fusion/next at version 1.27.34 or earlier with the Dialog component rendered and ConfigProvider.getContextProps called, and that attacker-controlled data flows into the locale argument processed by deepMerge. The CVSS 4.0 vector specifies PR:N and UI:N, meaning no authentication or user interaction is formally required at the component level, but in practice the attacker must have a path to supply a crafted locale value to the vulnerable function - typically through application endpoints, URL parameters, or API responses that populate the locale prop. Exploitation is limited by the requirement that the consuming application actually passes externally-sourced data into the locale prop rather than using static compile-time values; applications with fully static locale configurations present no exploitable surface despite the network-facing vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as remotely exploitable with no prerequisites, which is the maximum-exposure attack surface profile. Impact metrics are uniformly Low (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), consistent with the bounded-but-real consequences typical of prototype pollution in client-side UI libraries. EPSS data is absent from the available intelligence; KEV status is not listed, and no confirmed public exploit code exists. The GitHub issue was automatically closed due to inactivity, indicating neither the vendor nor the community has treated this as urgent. The E:X (exploitation unreported) modifier in the CVSS 4.0 vector means no exploitation evidence has been formally assessed. The practical risk ceiling depends heavily on application-specific code paths: if a consuming application passes user-controlled data into the locale prop and downstream logic reads from Object.prototype without sanitization, the impact could escalate beyond the Low ratings assigned here. Conversely, applications that only supply static locale values are unlikely to be exploitable in practice despite the network-facing vector.

An attacker who can influence the locale prop value passed to a Dialog or ConfigProvider component - for example, via a URL parameter, API response, or user-supplied settings - submits a crafted object such as {"__proto__": {"isAdmin": true}} as the locale value. The unguarded deepMerge function traverses __proto__ and sets the injected property on Object.prototype, causing every subsequently created object in the application to inherit isAdmin: true. If any security-sensitive code path (authorization checks, feature flags, rendering logic) reads this property without explicit own-property checks, the attacker achieves unintended privilege or behavior changes. No confirmed public exploit code exists, but prototype pollution payloads of this type are widely documented and trivially constructed.