Style Dictionary
Monthly
Prototype pollution in Style Dictionary's `convertTokenData()` utility function allows an attacker who can supply token data with a `__proto__`-keyed entry to corrupt `Object.prototype` globally, affecting all downstream object operations in the same runtime. All deployments using versions 4.3.0 through 5.4.3 on npm are affected, with severity scaling sharply by context: Node.js server applications ingesting untrusted token data face high-impact exploitation, while build-time-only pipelines with controlled token sources face low residual risk. A publicly available proof-of-concept exists (GitHub Gist), though SSVC signals exploitation activity as none at time of analysis.
Prototype pollution in Style Dictionary's `convertTokenData()` utility function allows an attacker who can supply token data with a `__proto__`-keyed entry to corrupt `Object.prototype` globally, affecting all downstream object operations in the same runtime. All deployments using versions 4.3.0 through 5.4.3 on npm are affected, with severity scaling sharply by context: Node.js server applications ingesting untrusted token data face high-impact exploitation, while build-time-only pipelines with controlled token sources face low residual risk. A publicly available proof-of-concept exists (GitHub Gist), though SSVC signals exploitation activity as none at time of analysis.