CVE-2026-54639

{
  "id": "CVE-2026-54639",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T01:16:25.363",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`."
    },
    {
      "lang": "es",
      "value": "Style Dictionary, un sistema de compilación para crear estilos multiplataforma, tiene una vulnerabilidad de contaminación de prototipos a partir de la versión 4.3.0 y anterior a la versión 5.4.4. El impacto para los usuarios es: uso directo de “convertTokenData(tokens, { output: ’object’ });”; uso indirecto, a través del uso de la API de Expand; y/o uso indirecto a través del ciclo de vida de transformación de SD. El impacto es alto para esto cuando style-dictionary se utiliza como una integración en una aplicación de servidor NodeJS. El impacto es moderado para cuando style-dictionary se utiliza como una integración en una aplicación web. El impacto es bajo para la mayoría de los casos comunes donde el usuario de style-dictionary también mantiene los tokens, y el acceso está limitado a través del acceso de lectura/escritura al repositorio/flujos de trabajo donde se utiliza. Se ha publicado un parche en la versión “5.4.4”. La única solución alternativa conocida es sanear los datos del token primero. Ya sea utilizando el formato DTCG o el formato antiguo de Style Dictionary, verifique el objeto de datos del token recursivamente para cualquier clave de objeto que incluya “__proto__”."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "style-dictionary",
          "product": "style-dictionary",
          "versions": [
            {
              "version": ">= 4.3.0, < 5.4.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-24T13:00:58.855282Z",
          "id": "CVE-2026-54639",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/style-dictionary/style-dictionary/pull/1702",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff",
      "source": "[email protected]"
    }
  ]
}