CVE-2026-85625

Name of the Vulnerable Software and Affected Versions sift (sift.js) versions prior to 17.1.4

Description The software enumerates query keys using a for...in loop, which traverses the object prototype chain and dispatches matched operator keys, including $where. The $where operation compiles a string value into a function using new Function unless CSP ENABLED is set, which is not the default configuration. This allows for remote code execution if a prototype pollution primitive sets Object.prototype.$where to a malicious string, causing even benign filter calls to execute arbitrary JavaScript. Additionally, passing an untrusted query object that contains a string $where directly to the software results in code execution.

Recommendations Update sift (sift.js) to version 17.1.4 or later. Set CSP ENABLED to block code generation.