CVE-2026-78180CWE-1321CWE-94code-injection

CVE-2026-78180

High · published August 24, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00539 · 44.6th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T08:16Z
References (7)
https://github.com/alibaba-fusion/next/ · [email protected]https://github.com/alibaba-fusion/next/issues/5101 · [email protected]https://vuldb.com/cve/CVE-2026-78180 · [email protected]https://vuldb.com/submit/884184 · [email protected]https://vuldb.com/vuln/394564 · [email protected]https://vuldb.com/vuln/394564/cti · [email protected]https://github.com/alibaba-fusion/next/issues/5101 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 24 AUG 03:15Z
    alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution
    cvelistv5