Executive brief
sift.js is a JavaScript library that applies MongoDB-style query filters to in-memory data. The library compiles user-provided strings into executable functions without proper validation, and uses unsafe prototype-chain walking when processing queries. An attacker can exploit this via prototype pollution or by directly passing malicious query objects to execute arbitrary JavaScript code on the host system.
Technical details
The vulnerability stems from two issues: (1) sift.js uses for...in loops to enumerate query keys, which walks the object prototype chain, allowing prototype-pollution attacks to inject operator keys; and (2) the $where operator compiles string values into functions using new Function() unless CSP_ENABLED is explicitly set (disabled by default). An attacker can trigger code execution either by exploiting a prototype-pollution primitive elsewhere in the application to set Object.prototype.$where to a malicious string, or by passing an untrusted query object containing a $where property directly to the sift() function. Both attack vectors bypass normal filters and execute arbitrary code under the default configuration.
Affected products
- sift.js sift 17.1.3
Timeline
- 2026-09-04: disclosed