@ablula/blog-jinchan (>=0.0.1, <=0.0.9), @ablula/default-blog-theme (>=0.0.1, <=0.0.6) +10959 more potentially affected by CVE-2026-78180 via @alifd/next (>=1.9.23, <=1.27.34)

@alifd/next NPM version =1.9.23, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =0.0.2, =0.0.1, =0.1.5 and more Source cves: CVE-2026-78180 Source advisory: SNYK:JS-ALIFDNEXT-19233840...

Prototype Pollution

Overview @alifd/next is an A configurable component library for web built on React. Affected versions of this package are vulnerable to Prototype Pollution due to the ConfigProvider.getContextProps function in components/dialog/index.tsx. An attacker can modify object prototype attributes by...