CVE-2026-54639: Style Dictionary Prototype Pollution Flaw

CVE-2026-54639 Overview

Style Dictionary is a build system for creating cross-platform styles used widely in design system tooling. CVE-2026-54639 is a prototype pollution vulnerability [CWE-1321] affecting versions 4.3.0 through 5.4.3. The flaw resides in the convertTokenData utility, which fails to filter token keys containing __proto__ before recursively building output objects. Attackers who control token data can inject properties into Object.prototype, altering application behavior across the runtime. Impact is high when Style Dictionary runs inside a Node.js server application, moderate inside web applications, and low when token data is fully maintained by trusted maintainers. The maintainers published a patch in version 5.4.4.

Critical Impact
An attacker who can supply token data to convertTokenData, the Expand API, or the transform lifecycle can pollute Object.prototype and influence server-side logic, leading to high confidentiality, integrity, and availability impact.

Affected Products

Style Dictionary versions 4.3.0 through 5.4.3
Applications calling convertTokenData(tokens, { output: 'object' }) directly
Applications using the Expand API or the Style Dictionary transform lifecycle

Discovery Timeline

2026-06-24 - CVE-2026-54639 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54639

Vulnerability Analysis

The vulnerability is a prototype pollution issue in the convertTokenData utility. Style Dictionary converts arrays of token objects into nested object structures using each token's key property as a dot-delimited path. The utility splits the key on . and walks the output object, creating intermediate objects as needed. When a key contains the segment __proto__, the walk reaches Object.prototype and writes attacker-controlled values to it. Polluted prototype properties then affect every object in the Node.js process. Reachable entry points include direct calls to convertTokenData, indirect use through the Expand API, and indirect use through the transform lifecycle that Style Dictionary executes during build.

Root Cause

The root cause is missing key sanitization in the recursive object-construction loop inside lib/utils/convertTokenData.js. The code accepted any string supplied as a token key, including reserved property names such as __proto__, constructor, and prototype. Without a guard, traversal of these keys mutated the global prototype chain rather than a fresh data object.

Attack Vector

An attacker supplies token data containing a malicious key such as __proto__.polluted. When Style Dictionary processes the tokens, the value associated with that key is written to Object.prototype.polluted and becomes visible to all objects in the process. In server-side integrations this can be used to override security-relevant defaults, alter control flow, or bypass property checks. The attack vector is local because the attacker must influence the token input consumed by a build or runtime process.

javascript

// Patch from lib/utils/convertTokenData.js (GHSA-vj5c-m527-mpff)
const obj = /** @type {Tokens} */ ({});
tokenArray.forEach((token) => {
  const { key } = token;
  // prototype pollution guard -> move to next token if key is malicious
  if (key?.includes('__proto__')) {
    return;
  }
  const keyArr = /** @type {string} */ (key).replace('{', '').replace('}', '').split('.');
  let slice = obj;
  keyArr.forEach((k, i, arr) => {
    // ...
  });
});

Source: Style Dictionary commit 23b5e8d

Detection Methods for CVE-2026-54639

Indicators of Compromise

Token JSON or DTCG files containing object keys that include the substring __proto__, constructor, or prototype.
Unexpected enumerable properties appearing on plain objects at runtime in Node.js processes that load Style Dictionary.
Build pipelines pulling Style Dictionary 4.3.0 through 5.4.3 from package-lock.json or yarn.lock.

Detection Strategies

Scan repositories for style-dictionary versions in the vulnerable range using software composition analysis tools.
Add a recursive linter step that walks token data and rejects any object key matching __proto__, constructor, or prototype.
Inspect CI build logs for errors or warnings emitted by convertTokenData, the Expand API, or transform hooks processing untrusted input.

Monitoring Recommendations

Monitor changes to package.json and lockfiles for downgrades or pinning of style-dictionary to versions below 5.4.4.
Alert on contributions to token files from external or untrusted contributors in design system repositories.
Track Node.js runtime errors referencing Object.prototype mutation in server processes that consume token output.

How to Mitigate CVE-2026-54639

Immediate Actions Required

Upgrade style-dictionary to version 5.4.4 or later in all projects and lockfiles.
Audit any direct callers of convertTokenData(tokens, { output: 'object' }) for untrusted input sources.
Restrict write access to repositories and workflows that supply token data to trusted maintainers.

Patch Information

The fix is included in Style Dictionary 5.4.4. The patch adds a prototype pollution guard inside lib/utils/convertTokenData.js that skips any token whose key contains __proto__. Details are published in the Style Dictionary security advisory GHSA-vj5c-m527-mpff and applied in pull request #1702.

Workarounds

Sanitize token data before passing it to Style Dictionary by recursively rejecting object keys containing __proto__, constructor, or prototype.
Avoid invoking convertTokenData with { output: 'object' } on untrusted input until the upgrade is applied.
Run Style Dictionary builds in isolated processes so that any prototype pollution does not persist into long-running server contexts.

bash

# Pin the patched version in package.json and refresh the lockfile
npm install style-dictionary@5.4.4 --save-exact
npm audit --production