HIGH 8.8 GitHub
CVE-2026-54639
Style Dictionary - Prototype Pollution in convertTokenData utility function
### Impact
Prototype pollution.
A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious' }]`, when processed by `convertTokenData()` utility function, it will pollute the Object.prototype globally where `{}.foo` will equal `{ key: '{__proto__.foo}', value: 'malicious' }`.
This has been confirmed with a test/reproduction.
You are impacted when:
- direct usage of `convertTokenData(tokens, { output: 'object' });`
- indirect usage, via using Expand API https://style
Affected Products
- npm/style-dictionary >= 4.3.0, < 5.4.4
References
- https://github.com/advisories/GHSA-vj5c-m527-mpff
- https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mp
- https://nvd.nist.gov/vuln/detail/CVE-2026-54639
- https://github.com/style-dictionary/style-dictionary/pull/1702
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-07-28 via GitHub. Affected: npm/style-dictionary >= 4.3.0, < 5.4.4.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.