{"id":"CVE-2026-85625","title":"sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where","summary":"sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1321","CWE-94"],"vendor":"crcn","product":"sift.js","affected":["sift.js <= 17.1.3"],"published":"2026-09-04","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:16:58.987","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85625","references":[{"url":"https://github.com/crcn/sift.js","label":"disclosure@vulncheck.com"},{"url":"https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/crcn/sift.js/issues/276","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85625.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85625"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533311"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85625"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85625"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.00547,"epssPercentile":0.4471,"exploits":{"github":1,"githubRepos":["https://github.com/lgranadoi/sift-hardened"],"checkedAt":"2026-09-23T07:15:06.411Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-14T19:20:21.665008Z"},"ingestedAt":"2026-09-10T16:57:28.704Z","slug":"CVE-2026-85625","body":"## Overview\n\nsift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2 · no fix planned: Red Hat Ansible Automation Platform 2 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85625.json)","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}