Prototype Pollution Vulnerability in Style Dictionary convertTokenData Function

A significant prototype pollution vulnerability, tracked as CVE-2026-54639, has been identified in the Style Dictionary library, affecting versions >=4.3.0 but prior to 5.4.4. This flaw resides within the convertTokenData() utility function. An attacker can exploit this by introducing a specially crafted token array, for instance, [{ key: '{__proto__.foo}', value: 'malicious' }]. When this malicious input is processed by the vulnerable function, it leads to a global pollution of the Object.prototype. This means that any object subsequently created within the application's runtime will inherit the injected foo property with an attacker-controlled value. The vulnerability can be triggered directly via convertTokenData(), indirectly through Style Dictionary's Expand API, or during its transform lifecycle. This poses a high risk to NodeJS server applications and a moderate risk to web applications using Style Dictionary, allowing for potential manipulation of application logic, bypass of security controls, or data tampering.

Attack Chain

1. An attacker identifies a target application using Style Dictionary versions >=4.3.0 and <5.4.4.
2. The attacker crafts a malicious token data structure, such as [{ key: '{__proto__.foo}', value: 'malicious' }], containing a key that targets the JavaScript __proto__ property.
3. The crafted token data is introduced into the vulnerable application, for example, through an untrusted configuration file, API endpoint, or user-controlled input.
4. The application processes the malicious token data, either by directly invoking the convertTokenData() utility function, or indirectly via Style Dictionary's Expand API or transform lifecycle mechanisms.
5. Due to insufficient sanitization and validation within the convertTokenData() function, the specially crafted __proto__ key is processed.
6. The Object.prototype is globally polluted, injecting a new property (foo) with an attacker-defined value (malicious) into all newly created objects, potentially leading to arbitrary code execution or logic manipulation.

Impact

The impact of this prototype pollution vulnerability varies depending on the application context. For NodeJS server applications integrating Style Dictionary, the impact is considered high, as global object modification can lead to severe consequences, including remote code execution, denial of service, or data manipulation. For web applications, the impact is rated as moderate, potentially leading to client-side attacks like cross-site scripting (XSS) or data exfiltration. In scenarios where the user of Style Dictionary also maintains the tokens and access is strictly controlled, the impact is low. Successful exploitation can enable attackers to manipulate application behavior, bypass authentication or authorization checks, or inject malicious properties into system-level objects, compromising the integrity and security of the affected application.

Recommendation

• Patch CVE-2026-54639 immediately by upgrading the npm/style-dictionary package to version 5.4.4 or higher.
• Implement the provided workaround by sanitizing all token data recursively to check for object keys containing __proto__ before processing them with Style Dictionary.
• Ensure that, if using the workaround, the expand configuration option in Style Dictionary is explicitly set to false to prevent indirect exploitation pathways.