Prototype pollution in a component library isn't the same as prototype pollution in an isolated utility, and CVE-2026-7818 deserves more attention than its CVSS 7.3 suggests. The vulnerability lives in ConfigProvider.getContextProps within alibaba-fusion-next version 1.27.34, where the locale argument passes directly to deepMerge without sanitizing proto, constructor, or prototype keys. This is textbook CWE-1321 — an attacker supplying a locale object with these properties corrupts Object.prototype for every subsequent object operation in the application context.
The real danger isn't the pollution itself; it's where it lives. Component libraries sit at the top of dependency trees, and every downstream consumer — every Dialog, every form, every page that imports this library — inherits the polluted prototype chain. Your application doesn't need to call ConfigProvider directly; it just needs to render a component that does. This is a transitive exposure that CVSS measures poorly because it evaluates the library in isolation.
The auto-closed issue compounds the problem. No public fix was merged, which means the vulnerable version remains on npm, still being installed by exact-version pins and baked into Docker layers that won't rebuild without a trigger. Standard dependency scanners flag this only if they have explicit signatures for this version pairing — many don't, because the auto-closure made the finding practically invisible to automated tooling.
What to check: audit your dependency tree for alibaba-fusion-next 1.27.34 specifically, and audit any alibaba-fusion-next version for downstream prototype pollution sinks. If you use this library, assume Object.prototype is corrupted after component initialization and audit code paths that trust Object.prototype properties. The CVSS score is almost irrelevant — the exposure is the unfixed pollution living silently in your runtime.