HIGH: style-dictionary — Style Dictionary - Prototype Pollution in convertTokenData utility function
Impact Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key:…
Source style-dictionaryPublished 6d ago · Jul 28, 2026Posted on Bluesky
What we hold
- Package
- style-dictionary
- Ecosystem
- npm
- Severity
- HIGH
- ID
- CVE-2026-54639
Impact Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key:…
More like this
HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…
HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer
Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…
CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…