The vulnerability is a prototype pollution flaw in the ConfigProvider.getContextProps function of Alibaba Fusion Next's deepMerge implementation found in components/dialog/index.tsx. By manipulating the locale argument an attacker can inject arbitrary properties into the JavaScript Object prototype, causing all objects to carry malicious data. This flaw does not directly grant code execution but can lead to data tampering, privilege escalation, cross‑site scripting or other downstream exploits depending on how the polluted prototype is used by the application. The weakness is classified under CWE-1321 and CWE-94.

Affected systems are projects that use the Alibaba Fusion Next framework through version 1.27.34 or earlier. The issue manifests in the dialog component's deepMerge routine. Any web application that incorporates the compromised library and exposes the locale parameter to untrusted input is vulnerable. The package is distributed under the name next:next in CPE terms, so any deployment of the library before the security fix is at risk.

The CVSS base score of 6.9 reflects a moderate level of severity and indicates that the flaw is exploitable remotely via user input to the locale field. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widely reported attacks yet. However, because the flaw allows implicit modification of the Object prototype, attackers could abuse this to inject malicious code or alter application data. The potential impact warrants swift action, particularly if the application processes locale values that can be supplied by external users.