Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-85625: sift 17.1.3 may run attacker code from query
CVE-2026-85625 · published today
Summary
The sift library version 17.1.3 can execute any JavaScript code that an attacker includes in a specially crafted query. This happens because the library looks at all properties of an object, including those inherited from the global prototype, and treats a $where field as code to run. Update to a newer version or disable the $where feature to stop this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| crcn | sift.js | <= 17.1.3 |
Original advisory text
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
References
- https://github.com/crcn/sift.js product
- https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts technical-description
- https://github.com/crcn/sift.js/issues/276 issue-tracking
- https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code... third-party-advisory
Severity
9.2
Critical
CVSS 3.1: 8.1 (NVD)
CVSS 4.0: 9.2 (NVD)
Type
CWE-1321Prototype Pollution
Timeline
Published4 Sep 2026
Updated4 Sep 2026
First seen4 Sep 2026
Monitor software like this
Free during beta