Product
The sift.js library version 17.1.3 is vulnerable to arbitrary code execution when processing untrusted input that leverages prototype pollution or malicious $where operator strings to invoke the new Function constructor.