Style Dictionary - Prototype Pollution in convertTokenData utility function
Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{proto.foo}', value: 'malicious' }. This has been confirmed with a test/reproduction. You are impacted when: direct usage of convertTokenData(tokens, { output: 'object' }); indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it …