sift.js vulnerabilities

CVEs whose affected-version data names the sift.js package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-85625High· 8.1PoC

sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where

sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function …

▾ Midnightcrcn · sift.jsEPSS 0.55%via NVD

sift.js vulnerabilities (CVEs) · VulnSea