High severity · published Aug 24, 2026
CVE-2026-78180
alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
next · alibaba-fusion
1.27.0; 1.27.1; 1.27.2; 1.27.3; 1.27.4; 1.27.5; +29 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78180
github.com
https://github.com/alibaba-fusion/next/
github.com
https://github.com/alibaba-fusion/next/issues/5101
vuldb.com
https://vuldb.com/cve/CVE-2026-78180
vuldb.com
https://vuldb.com/submit/884184
vuldb.com
https://vuldb.com/vuln/394564
vuldb.com
https://vuldb.com/vuln/394564/cti
More from next
–
CVE-1999-1468
rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable
–
CVE-1999-1193
The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become root
–
CVE-1999-1198
BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to gain root privileges
–
CVE-1999-1391
Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions
–
CVE-1999-1392
Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges