CVE-2026-54639

Name of the Vulnerable Software and Affected Versions Style Dictionary versions 4.3.0 through 5.4.3

Description Style Dictionary contains a prototype pollution issue within the convertTokenData() function. Prototype pollution occurs when an attacker manipulates the proto property of a JavaScript object, potentially allowing them to inject properties into the base object prototype and alter the behavior of the application. This issue can be triggered through direct usage of convertTokenData(tokens, { output: 'object' });, indirect usage via the Expand API, or through the transform lifecycle. The risk is highest when integrated into a NodeJS server application, moderate for Web applications, and low when token access is restricted to authorized repository workflows.

Recommendations Update to version 5.4.4. As a temporary workaround, recursively sanitize token data to ensure no object keys contain proto before processing.