EUVD-2026-38640
GHSA-vj5c-m527-mpff
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:N reflects highest-risk server deployments accepting untrusted token data; AC:H because exploitation depends on that specific deployment pattern; PR:L for typical authenticated token-submission workflows.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5Blast Radius
ecosystem impact- 1 npm packages depend on style-dictionary (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.3.0.
DescriptionCVE.org
Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenData(tokens, { output: 'object' });; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version 5.4.4. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include __proto__.
AnalysisAI
Prototype pollution in Style Dictionary's convertTokenData() utility function allows an attacker who can supply token data with a __proto__-keyed entry to corrupt Object.prototype globally, affecting all downstream object operations in the same runtime. All deployments using versions 4.3.0 through 5.4.3 on npm are affected, with severity scaling sharply by context: Node.js server applications ingesting untrusted token data face high-impact exploitation, while build-time-only pipelines with controlled token sources face low residual risk. A publicly available proof-of-concept exists (GitHub Gist), though SSVC signals exploitation activity as none at time of analysis.
Technical ContextAI
Style Dictionary (CPE: cpe:2.3:a:style-dictionary:style-dictionary) is a Node.js build system for cross-platform design tokens distributed via npm. The vulnerability resides in lib/utils/convertTokenData.js, specifically in the path-splitting logic (lines L40-L50) that converts a token array entry's key string into a nested object path via property assignment. When a token key such as {__proto__.a} is processed, the function dissects it into obj['__proto__']['a'] = value, mutating Object.prototype globally rather than setting a property on a normal object. This is a textbook CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) instance introduced in v4.3.0. The pollution is triggered through three surfaces: direct calls to convertTokenData(tokens, { output: 'object' }), the Expand API (when expand is not explicitly disabled), and the transform lifecycle sync of sd.tokens with sd.tokenMap.
RemediationAI
Upgrade to Style Dictionary v5.4.4, which patches lib/utils/convertTokenData.js to skip any token key containing __proto__ before the path-splitting assignment. The fix PR and commit are at https://github.com/style-dictionary/style-dictionary/pull/1702 and commit 23b5e8d. If upgrading is not immediately possible, the only confirmed workaround is to recursively scan all token data objects for any key containing __proto__ and reject or strip them before passing to the library. For users of the Expand API, additionally set expand: false in the StyleDictionary configuration to block the second exploitation path, noting this disables token expansion functionality. For Node.js server deployments ingesting untrusted token data, consider schema validation at the API boundary that rejects keys matching /(__proto__|constructor|prototype)/ before any processing.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Share
External POC / Exploit Code
Leaving vuln.today