CVE-2026-54639

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`.

• CWE-1321

• https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec
• https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5
• https://github.com/style-dictionary/style-dictionary/pull/1702
• https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54620sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-54621datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-5463Command injection vulnerability in console.run_module_with_o…9.8
• CVE-2026-54635pytonapi is a Python SDK for TONAPI that provides REST API, …7.5
• CVE-2026-54636Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron pl…9.9
• CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
• CVE-2026-5464The ExactMetrics – Google Analytics Dashboard for WordPress …7.2
• CVE-2026-5465The Booking for Appointments and Events Calendar – Amelia pl…8.8
• CVE-2026-54650openhole exposes localhost to the internet in one command. I…8.6
• CVE-2026-54651pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-54652Frigate is an open source network video recorder. In version…8.1
• CVE-2026-54653datamodel-code-generator generates Pydantic v2 models, datac…8.8