CVE-2026-54639

npm/style-dictionary CVE-2026-54639: high 8.8, EPSS 0.36%

Style Dictionary - Prototype Pollution in convertTokenData utility function

Action: Upgrade style-dictionary to 5.4.4 or later.

npm i style-dictionary@5.4.4

Affected

Fixed versions

Sources

• osv: GHSA-vj5c-m527-mpff
• https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff
• https://nvd.nist.gov/vuln/detail/CVE-2026-54639
• https://github.com/style-dictionary/style-dictionary/pull/1702
• https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec
• https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5
• https://github.com/style-dictionary/style-dictionary
• https://github.com/style-dictionary/style-dictionary/releases/tag/v5.4.4

CVE-2026-54639 · published 2026-07-28T22:23:03Z · modified 2026-07-28T22:30:30.999540552Z · JSON