Skip to content
Threat Feed
Subscribe

Vendor

Sift

1 brief RSS
high advisory

Arbitrary Code Execution in sift.js via Prototype Pollution and $where Operator

The sift.js library version 17.1.3 is vulnerable to arbitrary code execution when processing untrusted input that leverages prototype pollution or malicious $where operator strings to invoke the new Function constructor.

sift vulnerability code-execution prototype-pollution javascript cve-2026-85625
1t 1c