CVE-2026-85625 Details
Description
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
A vulnerability in Sift.js version 17.1.3 allows for prototype pollution, which can lead to remote code execution. This occurs because the library enumerates query keys using a for...in loop that traverses the object prototype chain. It dispatches any operator key it encounters, including $where. Under default settings, the $where operation can be exploited to execute arbitrary JavaScript by compiling a string into a function with new Function. This vulnerability can be triggered by setting Object.prototype.$where to a malicious string and then using Sift's filtering capabilities, or by directly passing an untrusted query object containing a string $where to the Sift function.
Users can update to Sift.js version 17.1.4, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/crcn/sift.js | [email protected] | ProductSource CodeVendor |
| https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts | [email protected] | Source CodeVendor |
| https://github.com/crcn/sift.js/issues/276 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| crcn sift.js | <= 17.1.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |