Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

style-dictionary

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmPublished

    Style Dictionary - Prototype Pollution in convertTokenData utility function

    CVE-2026-54639 · GHSA-vj5c-m527-mpff

    Affected
    • npm style-dictionary >= 4.3.0, < 5.4.4
    Fixed in
    5.4.4· Vendor fix available
    Issue
    Impact Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{proto.foo}', value: 'malicious' }. This has been confirmed with a test/reproduction. You are impacted when: - direct usage of convertTokenData(tokens, { output: 'object' }); - indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the sd.tokens property with the sd.tokenMap property by converting tokenData map back to object. - indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the sd.tokens property with the sd.tokenMap property. Impact is high for this when style-dictionary is used as an integration in…

    Recommended action: Upgrade to 5.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →