{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/style-dictionary--4.3.0--5.4.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-54639"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Style Dictionary (\u003e= 4.3.0, \u003c 5.4.4)"],"_cs_severities":["high"],"_cs_tags":["prototype-pollution","supply-chain","npm","nodejs"],"_cs_type":"advisory","_cs_vendors":["Style Dictionary"],"content_html":"\u003cp\u003eA significant prototype pollution vulnerability, tracked as CVE-2026-54639, has been identified in the Style Dictionary library, affecting versions \u003ccode\u003e\u0026gt;=4.3.0\u003c/code\u003e but prior to \u003ccode\u003e5.4.4\u003c/code\u003e. This flaw resides within the \u003ccode\u003econvertTokenData()\u003c/code\u003e utility function. An attacker can exploit this by introducing a specially crafted token array, for instance, \u003ccode\u003e[{ key: '{__proto__.foo}', value: 'malicious' }]\u003c/code\u003e. When this malicious input is processed by the vulnerable function, it leads to a global pollution of the \u003ccode\u003eObject.prototype\u003c/code\u003e. This means that any object subsequently created within the application's runtime will inherit the injected \u003ccode\u003efoo\u003c/code\u003e property with an attacker-controlled value. The vulnerability can be triggered directly via \u003ccode\u003econvertTokenData()\u003c/code\u003e, indirectly through Style Dictionary's Expand API, or during its transform lifecycle. This poses a high risk to NodeJS server applications and a moderate risk to web applications using Style Dictionary, allowing for potential manipulation of application logic, bypass of security controls, or data tampering.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target application using Style Dictionary versions \u003ccode\u003e\u0026gt;=4.3.0\u003c/code\u003e and \u003ccode\u003e\u0026lt;5.4.4\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious token data structure, such as \u003ccode\u003e[{ key: '{__proto__.foo}', value: 'malicious' }]\u003c/code\u003e, containing a key that targets the JavaScript \u003ccode\u003e__proto__\u003c/code\u003e property.\u003c/li\u003e\n\u003cli\u003eThe crafted token data is introduced into the vulnerable application, for example, through an untrusted configuration file, API endpoint, or user-controlled input.\u003c/li\u003e\n\u003cli\u003eThe application processes the malicious token data, either by directly invoking the \u003ccode\u003econvertTokenData()\u003c/code\u003e utility function, or indirectly via Style Dictionary's \u003ccode\u003eExpand API\u003c/code\u003e or \u003ccode\u003etransform lifecycle\u003c/code\u003e mechanisms.\u003c/li\u003e\n\u003cli\u003eDue to insufficient sanitization and validation within the \u003ccode\u003econvertTokenData()\u003c/code\u003e function, the specially crafted \u003ccode\u003e__proto__\u003c/code\u003e key is processed.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eObject.prototype\u003c/code\u003e is globally polluted, injecting a new property (\u003ccode\u003efoo\u003c/code\u003e) with an attacker-defined value (\u003ccode\u003emalicious\u003c/code\u003e) into all newly created objects, potentially leading to arbitrary code execution or logic manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this prototype pollution vulnerability varies depending on the application context. For NodeJS server applications integrating Style Dictionary, the impact is considered high, as global object modification can lead to severe consequences, including remote code execution, denial of service, or data manipulation. For web applications, the impact is rated as moderate, potentially leading to client-side attacks like cross-site scripting (XSS) or data exfiltration. In scenarios where the user of Style Dictionary also maintains the tokens and access is strictly controlled, the impact is low. Successful exploitation can enable attackers to manipulate application behavior, bypass authentication or authorization checks, or inject malicious properties into system-level objects, compromising the integrity and security of the affected application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54639 immediately by upgrading the \u003ccode\u003enpm/style-dictionary\u003c/code\u003e package to version \u003ccode\u003e5.4.4\u003c/code\u003e or higher.\u003c/li\u003e\n\u003cli\u003eImplement the provided workaround by sanitizing all token data recursively to check for object keys containing \u003ccode\u003e__proto__\u003c/code\u003e before processing them with Style Dictionary.\u003c/li\u003e\n\u003cli\u003eEnsure that, if using the workaround, the \u003ccode\u003eexpand\u003c/code\u003e configuration option in Style Dictionary is explicitly set to \u003ccode\u003efalse\u003c/code\u003e to prevent indirect exploitation pathways.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:23:45Z","date_published":"2026-07-28T22:23:45Z","id":"https://feed.craftedsignal.io/briefs/2026-07-style-dictionary-pollution/","summary":"A prototype pollution vulnerability exists in the Style Dictionary library, specifically within the `convertTokenData()` utility function, allowing malicious users to exploit it by crafting a token array containing `__proto__` keys, which, when processed, will globally pollute the `Object.prototype`, impacting NodeJS server applications and web applications.","title":"Prototype Pollution Vulnerability in Style Dictionary convertTokenData Function","url":"https://feed.craftedsignal.io/briefs/2026-07-style-dictionary-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Style Dictionary (\u003e= 4.3.0, \u003c 5.4.4)","version":"https://jsonfeed.org/version/1.1"}