sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.

sift.js version 17.1.3 contains a critical vulnerability where the library enumerates query keys using for...in, which traverses the object prototype chain and dispatches matched operator keys including $where. The $where operator compiles string values into executable functions via new Function(), which is enabled by default (CSP_ENABLED is not set by default). This creates two attack vectors: first, if a prototype-pollution primitive elsewhere sets Object.prototype.$where to a malicious string, even benign sift({}) calls execute arbitrary JavaScript; second, passing an untrusted query object with a string $where directly to sift results in immediate code execution. The vulnerability effectively chains prototype pollution with arbitrary code execution in Node.js environments using this widely-used MongoDB-style query filtering library. Mitigation requires enabling CSP_ENABLED or upgrading to a patched version. The issue has been reported via GitHub and tracked by VulnCheck.