CVE-2026-85625

sift.js 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, so an inherited key such as Object.prototype.$where is dispatched as a query operator, and string $where values are compiled with new Function unless the non-default CSP_ENABLED option is set. An attacker gains arbitrary JavaScript execution by chaining any prototype-pollution bug elsewhere in the application to set Object.prototype.$where, after which even benign filter calls such as sift({}) run the injected code; alternatively, an untrusted query object containing a string $where passed directly to sift executes code under the default configuration. The impact is code execution in the host Node.js process, reflected in the critical 9.2 CVSS 4.0 score (network vector, with the required prior condition captured by the attack-requirements metric). Any application or service bundling this npm package with default settings, where untrusted queries reach sift or a prototype-pollution sink exists, is potentially affected; sift is a widely downloaded JavaScript filtering dependency, so downstream use is broad. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Audit dependency trees (e.g., npm ls sift) for sift 17.1.3, and review applications for prototype-pollution sources and any path where untrusted query objects containing string $where reach sift calls; upgrade to a patched release when one becomes available, since the advisory does not list a fixed version. As interim hardening, enable the CSP_ENABLED option where supported and strip or sanitize $where keys from untrusted queries before filtering.