Prototype Pollution and Remote Code Execution in Sift.js by CRCN

CVE-2026-85625

What is CVE-2026-85625?

The Sift.js library version 17.1.3 is susceptible to a vulnerability that enables prototype pollution through its enumeration of query keys using the for...in statement. This method traverses the object prototype chain and inadvertently triggers any potentially harmful operator key, including $where. If an external prototype-pollution primitive modifies Object.prototype.$where to a malicious string, even regular filter calls will run arbitrary JavaScript code. Additionally, providing untrusted query input consisting of a string $where directly to Sift leads to code execution by default, which is particularly concerning in environments lacking Content Security Policy (CSP) settings.

References