CVE-2026-85625: sift 17.1.3 Prototype Pollution Remote Code Execution via $where
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSPENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sift.jsto a version that resolves this vulnerability.Fixed in 17.1.3 - Upgrade
Upgrade
sift.jsto a version that resolves this vulnerability.Patch 17.1.3 Prototype Pollution Remote Code Execution via $where - Configuration
Enable CSP_ENABLED so sift $where does not compile untrusted string values into functions using new Function.
sift.js CSP_ENABLED = set to true
Event History
Frequently Asked Questions
What inputs or conditions can lead to exploitation?
An attacker can exploit the issue by supplying an untrusted query object with a string-valued $where property to sift. Exploitation can also occur after a separate prototype-pollution issue sets Object.prototype.$where to a malicious string, causing otherwise benign calls such as sift({}) to execute it.
Is the default configuration affected?
Yes. The $where operation uses new Function unless CSP_ENABLED is set, and CSP_ENABLED is not set by default.
Who is realistically exposed?
Applications are exposed if they pass attacker-controlled query objects to sift, or if another vulnerability or unsafe code path can pollute Object.prototype.$where in the same process. Network exposure depends on whether untrusted users can reach those application inputs.
What can be done if patching is not immediately possible?
Do not pass untrusted query objects to sift, and reject or remove $where keys from query data. Enable CSP_ENABLED and address any prototype-pollution primitives that could modify Object.prototype.$where.