CVE-2026-85625: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in crcn sift.js

sift.js versions up to 17.1.3 use for...in enumeration on query keys, which walks the prototype chain and dispatches operator keys such as $where. The $where operator compiles a string into a function using new Function unless CSP_ENABLED is set. If an attacker can perform prototype pollution to set Object.prototype.$where to a malicious string, sift.js will execute arbitrary JavaScript code during filter operations, including benign calls like sift({}). Passing an untrusted query object with a string $where also results in code execution under default settings.

This vulnerability allows an attacker to execute arbitrary JavaScript code remotely without privileges or user interaction, leading to a critical security breach. The impact includes potential full compromise of applications using vulnerable sift.js versions, as arbitrary code execution can lead to data theft, system takeover, or further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a temporary mitigation, enable the CSP_ENABLED flag if possible to prevent the compilation of arbitrary code via the $where operator. Avoid passing untrusted query objects containing $where strings to sift.js. Monitor vendor channels for an official fix.