Skip to content
OpenAdvisories

Vendor

crcn

1 known vulnerabilities.

Products

sift.js 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-85625 Public exploit

    sift 17.1.3 Prototype Pollution Remote Code Execution via $where

    sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is …

    crcn sift.js