Description

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T04:16:58.647Z",
  "pubdate": "2026-08-24T04:16:58.647Z",
  "executiveSummary": "A security flaw has been identified in the alibaba-fusion next component up to version 1.27.34, specifically within the deepMerge component.\nThe vulnerability involves improperly controlled modification of object prototype attributes, commonly known as prototype pollution, via the locale argument handled by the ConfigProvider.getContextProps function in components/dialog/index.tsx.\nThis vulnerability allows remote attackers to manipulate object prototypes, potentially leading to unauthorized modification of application behavior, denial of service, or remote code execution depending on downstream application logic.\nThe attack can be initiated remotely without requiring prior authentication or special privileges, increasing the overall risk to deployed applications utilizing the affected component.\nOrganizations using vulnerable versions of alibaba-fusion next must take immediate defensive actions to mitigate potential exploitation risks.",
  "technicalDetails": "The vulnerability resides in the deepMerge component utilized by alibaba-fusion next up to version 1.27.34, specifically affecting the ConfigProvider.getContextProps function located within components/dialog/index.tsx.\nThe root cause is improper input validation and insecure object merging practices when processing the locale argument. When untrusted input containing specially crafted properties such as __proto__, constructor, or prototype is recursively merged, the properties are applied directly to the global JavaScript Object prototype rather than an instance-specific object.\nAttackers can initiate this attack remotely by supplying a maliciously crafted payload via network inputs that influence the locale argument passed to the vulnerable function.\nStep-by-step attack flow: 1. The attacker crafts a malicious input payload containing properties targeting the object prototype. 2. The application passes this payload into the ConfigProvider.getContextProps function or the underlying deepMerge utility. 3. The vulnerable merging logic fails to sanitize or restrict keys like __proto__. 4. The prototype of the base Object is polluted with attacker-controlled properties or methods. 5. Subsequent application operations reference the polluted prototype, altering control flow, triggering unexpected application behavior, or corrupting state across the entire JavaScript runtime environment.\nThe affected component is deepMerge within alibaba-fusion next versions up to 1.27.34. Exploitation requires network exposure of the application interface processing the untrusted locale argument, but does not require authentication or elevated privileges."
}