sift.js vulnerabilities

1 known vulnerability in sift.js from Crcn. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  sift.js: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-85625Sep 4, 2026Crcn

  sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is s