CVE-2026-85625
Received Received - Intake

Prototype Pollution Leads to Code Execution in sift.js

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85625
EUVD
EUVD-2026-71232

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
crcn sift.js 17.1.3
sift sift.js 17.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in sift.js 17.1.3 allows prototype pollution where malicious code can set Object.prototype.$where to a string. When sift processes queries, it compiles this string into a function using new Function, enabling arbitrary JavaScript execution even in benign filter calls like sift({}).

Additionally, passing an untrusted query object with a $where string directly to sift results in code execution under default settings.

Detection Guidance

To detect this vulnerability, inspect your JavaScript applications using sift.js 17.1.3 for prototype pollution vectors. Check if Object.prototype.$where can be manipulated via untrusted input. Review code for for...in loops in query handling and ensure CSP_ENABLED is set to mitigate $where execution.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in your application's context. This could lead to data theft, unauthorized actions, or full system compromise depending on the application's privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade sift.js to a patched version that addresses prototype pollution and $where operator risks. If upgrading is not possible, disable the $where operator by setting CSP_ENABLED to true in the configuration. Review any code using sift.js for prototype pollution vulnerabilities and ensure Object.prototype is not modified by untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart