Description

sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T15:17:42.880Z",
  "pubdate": "2026-09-04T15:17:42.880Z",
  "executiveSummary": "The library sift (sift.js) version 17.1.3 is vulnerable to Remote Code Execution (RCE) via insecure deserialization and prototype pollution. The root cause lies in the application's reliance on 'for...in' loops to enumerate object properties, which includes the prototype chain, combined with the dynamic evaluation of user-supplied input via 'new Function'.\nThis vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the Node.js process. The attack can be initiated by either polluting the global 'Object.prototype' with a malicious '$where' operator or by passing an untrusted query object directly to the sift function. By default, the 'CSP_ENABLED' protection mechanism is disabled, providing no inherent barrier against this arbitrary code execution. The impact is critical, as it grants an attacker complete control over the application's execution environment, potentially leading to unauthorized data access, system compromise, or lateral movement within the infrastructure. This flaw is exploitable without authentication, provided the attacker can influence the input objects processed by the library.",
  "technicalDetails": "The vulnerability resides in the core query processing logic of sift.js 17.1.3, specifically within how it parses and dispatches operators. The library employs a 'for...in' loop to iterate over the keys of a query object. In JavaScript, 'for...in' does not restrict iteration to the object's own enumerable properties but traverses the entire prototype chain.\nThe vulnerability manifest in two primary vectors: 1) Prototype Pollution: If an attacker leverages a separate prototype pollution vulnerability to inject a property '$where' into 'Object.prototype', every object processed by sift subsequently inherits this property. Because sift iterates over the prototype chain, it incorrectly interprets this inherited property as a valid query operator. 2) Direct Injection: An attacker can pass a specifically crafted query object containing a string-based '$where' operator directly to the sift function.\nWhen the '$where' operator is encountered, the library utilizes 'new Function()' to compile the associated string value into an executable function. Because 'CSP_ENABLED' is not enabled by default, there is no validation or sandbox layer preventing the execution of arbitrary strings. This effectively creates a sink for arbitrary code injection.\nStep-by-step attack flow: First, the attacker identifies a entry point where input is processed by sift. In a prototype pollution scenario, the attacker first triggers a primitive to set 'Object.prototype.$where = \"...malicious code...\"'. Second, the attacker triggers any standard, otherwise benign call to sift. Third, sift's internal iterator encounters the '$where' property due to prototype traversal. Fourth, the library treats the string as a legitimate operator and passes it to the internal mechanism that invokes 'new Function()'. Fifth, the malicious code is compiled and executed within the runtime context of the application. Finally, the attacker achieves RCE, allowing them to perform actions such as reading environment variables, accessing internal file systems, or spawning a reverse shell, all executing with the permissions of the application process."
}