Vulnerability in style-dictionary (CVE-2026-54639)

Impact

Prototype pollution.
A malicious user can create a token array [{ key: '{__proto__.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{__proto__.foo}', value: 'malicious' }.

This has been confirmed with a test/reproduction.

You are impacted when:

• direct usage of convertTokenData(tokens, { output: 'object' });
• indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the sd.tokens property with the sd.tokenMap property by converting tokenData map back to object.
• indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the sd.tokens property with the sd.tokenMap property.

Impact is high for this when style-dictionary is used as an integration in a NodeJS server application.
Impact is moderate for when style-dictionary is used as an integration in a Web application.
Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used.

Patches

A patch has been published: version 5.4.4.
Any version within range >=4.3.0 <5.4.4 contains this vulnerability, see commit hash 209085d for…