| शीर्षक | Node.js @alifd/next 1.27.34 Prototype Pollution |
|---|
| विवरण | A prototype pollution vulnerability exists in @alifd/next 1.27.34.
The affected package exposes locale and configuration merging logic through ConfigProvider. ConfigProvider.getContextProps(props, displayName) accepts locale/config input and calls an internal deepMerge helper with user-controlled data. The helper recursively merges object properties without rejecting dangerous keys such as proto, constructor, or prototype.
When a crafted locale/config object contains an own proto property, the merge operation can resolve target["proto"] to Object.prototype and write attacker-controlled properties globally. This pollutes Object.prototype and may cause later plain objects to inherit unexpected properties.
The issue is reachable through public configuration paths including component locale props, ConfigProvider locale context, ConfigProvider.setLocale(), ConfigProvider.initLocales(), and static component APIs that call ConfigProvider.getContextProps.
Affected version:
@alifd/next 1.27.34
Impact:
Prototype pollution through public UI configuration / locale merge APIs. Exploitability depends on applications loading untrusted or partially trusted locale, tenant branding, remote UI config, or component configuration into Fusion Next.
Recommended fix:
Reject __proto__, constructor, and prototype keys before reading or writing dynamic merge keys. Use own-property checks and avoid recursively merging into inherited prototype objects. |
|---|
| स्रोत | ⚠️ https://github.com/alibaba-fusion/next/issues/5101 |
|---|
| उपयोगकर्ता | wjm3 (UID 99672) |
|---|
| सबमिशन | 09/07/2026 02:58 PM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 06:04 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394564 [alibaba-fusion next तक 1.27.34 deepMerge index.tsx ConfigProvider.getContextProps locale दूरस्थ कोड निष्पादन] |
|---|
| अंक | 20 |
|---|