{"action":"Upgrade style-dictionary to 5.4.4 or later.","affected":[{"fixed":"5.4.4","introduced":"4.3.0"}],"component":"style-dictionary","cve_ids":["CVE-2026-54639"],"ecosystem":"npm","epss":0.00357,"exploited":false,"fixed_versions":["5.4.4"],"ghsa_id":"GHSA-vj5c-m527-mpff","id":"tcs_01M5KGC3ZP7Z6QZW8WQ5W9MXY0","modified_at":"2026-07-28T22:30:30.999540552Z","published_at":"2026-07-28T22:23:03Z","references":["https://osv.dev/vulnerability/GHSA-vj5c-m527-mpff","https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff","https://nvd.nist.gov/vuln/detail/CVE-2026-54639","https://github.com/style-dictionary/style-dictionary/pull/1702","https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec","https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5","https://github.com/style-dictionary/style-dictionary","https://github.com/style-dictionary/style-dictionary/releases/tag/v5.4.4"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-vj5c-m527-mpff","url":"https://osv.dev/vulnerability/GHSA-vj5c-m527-mpff"}],"summary":"Style Dictionary - Prototype Pollution in convertTokenData utility function"}