CVE-2026-54639

Style Dictionary - Prototype Pollution in convertTokenData utility function

Published

2026-07-28

Modified

2026-07-28

EPSS percentile

3%

Aliases

GHSA-vj5c-m527-mpff

Sources

github-advisory

Summary

### Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious' }]`, when processed by `convertTokenData()` utility function, it will pollute the Object.prototype globally where `{}.foo` will equal `{ key: '{__proto__.foo}', value: 'malicious' }`. This has been confirmed with a test/reproduction. You are impacted when: - direct usage of `convertTokenData(tokens, { output: 'object' });` - indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the `sd.tokens` property with the `sd.tokenMap` property by converting tokenData map back to object. - indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the `sd.tokens` property with the `sd.tokenMap` property. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. ### Patches A patch has been published: version `5.4.4`. Any version within range `>=4.3.0 tok.key.includes('__proto__')) { throw new Error('Found malicious token key, attempting to do prototype pollution.') } ```

Affected packages

Remediation: Upgrade to 5.4.4 or later.

References

• https://github.com/advisories/GHSA-vj5c-m527-mpff