This vulnerability in alibaba-fusion next (versions =1.27.0 through =1.27.34) arises from improper handling of the locale argument in the ConfigProvider.getContextProps function within the deepMerge component. An attacker can manipulate this argument to cause unintended modification of object prototype attributes, potentially leading to security issues related to prototype pollution. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation level has been published, and no known exploits are reported in the wild. The related GitHub issue was closed due to inactivity.

The vulnerability allows remote attackers to manipulate object prototype attributes improperly, which can lead to security risks such as prototype pollution. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no required privileges or user interaction. However, the exact impact beyond prototype attribute modification is not detailed in the available data.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is released, users should consider avoiding use of affected versions or applying custom mitigations to validate and sanitize inputs to the ConfigProvider.getContextProps function, specifically the locale argument.