@aios-alpha/design (>=0.2.1, <=0.3.0), @aleph-alpha/design-tokens (>=0.2.0, <=1.1.0) +145 more potentially affected by CVE-2026-54639 via style-dictionary (>=4.3.0, <=5.4.0)

style-dictionary NPM version =4.3.0, =0.2.1, =0.2.0, =1.0.0, =1.0.0, =0.1.2, =0.1.1, =0.0.12-beta.1, =0.1.1, =0.1.2 and more Source cves: CVE-2026-54639 Source advisory: OSV:GHSA-VJ5C-M527-MPFF...

NPM: Style Dictionary - Prototype Pollution in convertTokenData utility function

Prototype Pollution in convertTokenData utility function vulnerability discovered by ? in WordPress Npm style-dictionary versions = 4.3.0, 5.4.4...

GHSA-VJ5C-M527-MPFF Style Dictionary - Prototype Pollution in convertTokenData utility function

Impact Prototype pollution. A malicious user can create a token array key: 'proto.foo', value: 'malicious' , when processed by convertTokenData utility function, it will pollute the Object.prototype globally where .foo will equal key: 'proto.foo', value: 'malicious' . This has been confirmed with...

Style Dictionary - Prototype Pollution in convertTokenData utility function

Impact Prototype pollution. A malicious user can create a token array key: 'proto.foo', value: 'malicious' , when processed by convertTokenData utility function, it will pollute the Object.prototype globally where .foo will equal key: 'proto.foo', value: 'malicious' . This has been confirmed with...

EUVD-2026-38640

Style Dictionary - Prototype Pollution in convertTokenData utility function...

CVE-2026-54639

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

Prototype Pollution

Overview style-dictionary is a Style once, use everywhere. A build system for creating cross-platform styles. Affected versions of this package are vulnerable to Prototype Pollution via the convertTokenData function. An attacker can modify the prototype of built-in objects by supplying crafted...

@aios-alpha/design (>=0.2.1, <=0.3.0), @aleph-alpha/design-tokens (>=0.2.0, <=1.1.0) +145 more potentially affected by CVE-2026-54639 via style-dictionary (>=4.3.0, <=5.4.0)

style-dictionary NPM version =4.3.0, =0.2.1, =0.2.0, =1.0.0, =1.0.0, =0.1.2, =0.1.1, =0.0.12-beta.1, =0.1.1, =0.1.2 and more Source cves: CVE-2026-54639 Source advisory: SNYK:JS-STYLEDICTIONARY-17440157...

CVE-2026-54639 Style Dictionary - Prototype Pollution in convertTokenData utility function

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

CVE-2026-54639

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

CVE-2026-54639

CVE-2026-54639 affects Style Dictionary prior to 5.4.4, with a prototype pollution vulnerability in the convertTokenData utility (versions 4.3.0–4.x before 5.4.4). The impact is high when Style Dictionary is used as a Node.js server integration, moderate for web app integrations, and low for toke...

CVE-2026-54639 Style Dictionary - Prototype Pollution in convertTokenData utility function

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

CVE-2026-54639 Style Dictionary - Prototype Pollution in convertTokenData utility function

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

CVE-2026-54639: Improperly Controlled Modification of Object Prototype Attributes

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

PT-2026-51612

Name of the Vulnerable Software and Affected Versions Style Dictionary versions 4.3.0 through 5.4.3 Description Style Dictionary contains a prototype pollution issue within the convertTokenData function. Prototype pollution occurs when an attacker manipulates the proto property of a JavaScript...

Prototype Pollution

style-dictionary is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

@fluentui/token-pipeline (>=0.3.3, <=0.22.0), @inmotionnow/momentum-components (>=8.2.2-next.2, <=102.38.0) +7 more potentially affected by unknown CVE via style-dictionary (>=2.5.0, <=2.10.2)

style-dictionary NPM version =2.5.0, =0.3.3, =8.2.2-next.2, =1.0.2, =0.1.0, =0.0.2, =1.0.0, =8.1.3, =6.0.0, =8.2.2-next.2 Source cves: unknown CVE Source advisory: SNYK:JS-STYLEDICTIONARY-1080632...

Prototype Pollution

Overview style-dictionary is a Style once, use everywhere. A build system for creating cross-platform styles. Affected versions of this package are vulnerable to Prototype Pollution. PoC const StyleDictionary = require'style-dictionary'; const obj = ; let opts =...