A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.

A security flaw has been identified in alibaba-fusion/next up to version 1.27.34, involving a prototype pollution vulnerability. The issue resides in the ConfigProvider.getContextProps function within components/dialog/index.tsx, specifically in the deepMerge component. Manipulation of the locale argument leads to improperly controlled modification of object prototype attributes, a classic prototype pollution attack vector. The vulnerability can be exploited remotely without requiring local access. The flaw was reported via a GitHub issue, but the issue was closed automatically due to inactivity, suggesting no official patch or acknowledgment from maintainers. Prototype pollution vulnerabilities can have serious consequences, including property injection, logic manipulation, and potential remote code execution depending on the application context. The vulnerability affects a widely used React-based UI component library maintained by Alibaba.