CVE-2026-54639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54639", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T20:07:02.186Z", "datePublished": "2026-06-24T00:17:44.889Z", "dateUpdated": "2026-06-24T13:02:09.090Z"}, "containers": {"cna": {"title": "Style Dictionary - Prototype Pollution in convertTokenData utility function", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff"}, {"name": "https://github.com/style-dictionary/style-dictionary/pull/1702", "tags": ["x_refsource_MISC"], "url": "https://github.com/style-dictionary/style-dictionary/pull/1702"}, {"name": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec", "tags": ["x_refsource_MISC"], "url": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec"}, {"name": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5", "tags": ["x_refsource_MISC"], "url": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5"}], "affected": [{"vendor": "style-dictionary", "product": "style-dictionary", "versions": [{"version": ">= 4.3.0, < 5.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T00:17:44.889Z"}, "descriptions": [{"lang": "en", "value": "Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`."}], "source": {"advisory": "GHSA-vj5c-m527-mpff", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-24T13:00:58.855282Z", "id": "CVE-2026-54639", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:02:09.090Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T13:00:58.855282Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:02:04.319Z"}}], "cna": {"title": "Style Dictionary - Prototype Pollution in convertTokenData utility function", "source": {"advisory": "GHSA-vj5c-m527-mpff", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "style-dictionary", "product": "style-dictionary", "versions": [{"status": "affected", "version": ">= 4.3.0, < 5.4.4"}]}], "references": [{"url": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff", "name": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/style-dictionary/style-dictionary/pull/1702", "name": "https://github.com/style-dictionary/style-dictionary/pull/1702", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec", "name": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5", "name": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T00:17:44.889Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54639", "state": "PUBLISHED", "dateUpdated": "2026-06-24T13:02:09.090Z", "dateReserved": "2026-06-15T20:07:02.186Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T00:17:44.889Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "style-dictionary", "vendor": "style-dictionary", "versions": [{"status": "affected", "version": ">= 4.3.0, < 5.4.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`."}, {"lang": "es", "value": "Style Dictionary, un sistema de compilaci\u00f3n para crear estilos multiplataforma, tiene una vulnerabilidad de contaminaci\u00f3n de prototipos a partir de la versi\u00f3n 4.3.0 y anterior a la versi\u00f3n 5.4.4. El impacto para los usuarios es: uso directo de \u201cconvertTokenData(tokens, { output: \u2019object\u2019 });\u201d; uso indirecto, a trav\u00e9s del uso de la API de Expand; y/o uso indirecto a trav\u00e9s del ciclo de vida de transformaci\u00f3n de SD. El impacto es alto para esto cuando style-dictionary se utiliza como una integraci\u00f3n en una aplicaci\u00f3n de servidor NodeJS. El impacto es moderado para cuando style-dictionary se utiliza como una integraci\u00f3n en una aplicaci\u00f3n web. El impacto es bajo para la mayor\u00eda de los casos comunes donde el usuario de style-dictionary tambi\u00e9n mantiene los tokens, y el acceso est\u00e1 limitado a trav\u00e9s del acceso de lectura/escritura al repositorio/flujos de trabajo donde se utiliza. Se ha publicado un parche en la versi\u00f3n \u201c5.4.4\u201d. La \u00fanica soluci\u00f3n alternativa conocida es sanear los datos del token primero. Ya sea utilizando el formato DTCG o el formato antiguo de Style Dictionary, verifique el objeto de datos del token recursivamente para cualquier clave de objeto que incluya \u201c__proto__\u201d."}], "id": "CVE-2026-54639", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54639", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-24T13:00:58.855282Z", "version": "2.0.3"}}]}, "published": "2026-06-24T01:16:25.363", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec"}, {"source": "security-advisories@github.com", "url": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5"}, {"source": "security-advisories@github.com", "url": "https://github.com/style-dictionary/style-dictionary/pull/1702"}, {"source": "security-advisories@github.com", "url": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,5.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "style-dictionary", "source": "cna", "vendor": "style-dictionary"}, "product": "style-dictionary", "vendor": "style-dictionary"}], "created": "2026-06-24T03:30:05.211050+00:00", "updated": "2026-06-24T16:05:20.349087+00:00", "vendors": ["style-dictionary", "style-dictionary$PRODUCT$style-dictionary"]}