Approved changes feed: RSS · Atom
cpe:2.3:a:crcn:sift.js:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Crcn (f579f46b-cad6-57cb-930a-38f0ad5ec988) |
|---|---|
| Product | Sift.Js (05d1fc67-6c6b-5181-ba5b-ecfe2b8337df) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-85625 |
vulnerable | 2026-09-16 04:33:08.048093 |
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
HIGH (8.1)
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
Published: 2026-09-04T14:32:15.388Z
Updated: 2026-09-14T19:33:09.188Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.