CVE-2026-54639: Prototype Pollution and Patch Bypass in style-dictionary
Vulnerability ID: CVE-2026-54639
CVSS Score: 8.8
Published: 2026-07-28
A critical prototype pollution vulnerability (CVE-2026-54639) exists in style-dictionary versions 4.3.0 through 5.4.3 due to unsafe object traversal in the convertTokenData utility. Although a patch was released in version 5.4.4 targeting 'proto', a complete bypass is possible using 'constructor.prototype', leading to persistent global prototype pollution and potential remote code execution.
TL;DR
style-dictionary is vulnerable to prototype pollution via convertTokenData. An incomplete patch in v5.4.4 can be bypassed using constructor.prototype, allowing global runtime pollution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1321
- Vulnerability Class: Prototype Pollution
- CVSS v3.1 Score: 8.8 (High)
- Attack Vector: Local (escalatible to Remote)
- EPSS Score: 0.00132 (3.12 percentile)
- Patch Status: Incomplete (v5.4.4 bypass identified)
- CISA KEV Status: Not listed
Affected Systems
- style-dictionary NPM package
-
style-dictionary: >= 4.3.0, <= 5.4.3 (Fixed in:
5.4.4 (Incomplete fix))
Code Analysis
Commit: 209085d
Introduces the convertTokenData utility and vulnerable convertToTokenObject function.
Commit: 23b5e8d
Attempts to mitigate prototype pollution by introducing a check for 'proto'.
Exploit Details
- GitHub Advisory GHSA-vj5c-m527-mpff: Advisory documenting prototype pollution and detailing the vulnerable utility code.
Mitigation Strategies
- Validate and sanitize all design token input keys before passing to the conversion function.
- Override convertToTokenObject behavior or use Object.create(null) for dynamic dictionary construction.
- Upgrade to a secure patched version once a complete remediation block is deployed.
Remediation Steps:
- Identify applications utilizing style-dictionary's convertTokenData utility dynamically with user-controlled input.
- Deploy a custom input sanitizer regex pattern to block keys containing 'proto', 'constructor', or 'prototype'.
- Refactor code to construct design token maps using secure JSON Schema validation.
References
Read the full report for CVE-2026-54639 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)