CVE-2026-85625: sift.js RCE Vulnerability

CVE-2026-85625 Overview

CVE-2026-85625 is a prototype pollution vulnerability in sift.js version 17.1.3 that enables remote code execution [CWE-1321]. The library enumerates query keys using for...in, which walks the object prototype chain and dispatches any matched operator key including $where. The $where operator compiles a string value into a function using new Function unless CSP_ENABLED is set, which is not the default. An attacker who controls a query object or who has an existing prototype pollution primitive elsewhere in the process can achieve arbitrary JavaScript execution. Even benign filter calls such as sift({}) execute attacker-controlled code once Object.prototype.$where is polluted.

Critical Impact

Arbitrary JavaScript execution in the Node.js process context, leading to full application compromise, data exfiltration, and lateral movement.

Affected Products

• sift.js version 17.1.3
• Node.js applications importing sift for MongoDB-style query filtering
• Downstream libraries and services that expose sift filters to untrusted input

Discovery Timeline

• 2026-09-04 - CVE-2026-85625 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85625

Vulnerability Analysis

The root defect is an unsafe combination of prototype-chain traversal and dynamic code compilation. sift.js iterates query object keys with for...in, which by design traverses inherited properties. When any key matches a supported operator, sift dispatches the corresponding handler. The $where handler passes the operand string directly into new Function, producing an executable function that is then invoked against the filtered data.

Because the default configuration does not set CSP_ENABLED, the new Function path is always live. This turns any prototype pollution primitive elsewhere in the process into a reliable remote code execution sink. A single write to Object.prototype.$where weaponizes every subsequent sift() invocation, including calls with empty or trusted query objects.

Root Cause

The root cause is CWE-1321: improperly controlled modification of object prototype attributes combined with reachable code-generation. Query key enumeration does not filter inherited properties, and the $where operator lacks a safe-by-default execution mode. Applications that never intended to expose $where still evaluate polluted prototype entries as executable code.

Attack Vector

Two exploitation paths exist. First, an application that forwards untrusted JSON directly into sift() as a query object allows an attacker to submit {"$where": "malicious code"} and trigger execution under the default configuration. Second, an attacker who reaches an unrelated prototype pollution gadget can set Object.prototype.$where to a malicious payload; any downstream sift() call, including sift({}), then executes the payload. Both paths yield code execution in the Node.js runtime with the privileges of the host process. See the VulnCheck Advisory on Sift.js and GitHub Issue #276 for technical details.

Detection Methods for CVE-2026-85625

Indicators of Compromise

• Unexpected child processes spawned by Node.js workers that host sift consumers.
• Outbound network connections from Node.js processes to unknown hosts shortly after query traffic.
• Presence of $where keys in inbound JSON payloads to endpoints that accept filter objects.
• Runtime modifications to Object.prototype observed via application telemetry or heap inspection.

Detection Strategies

• Perform Software Composition Analysis (SCA) to identify direct and transitive dependencies on sift@17.1.3.
• Add runtime assertions that reject requests containing reserved keys such as $where, __proto__, constructor, and prototype.
• Instrument new Function and eval calls in Node.js with hooks to log invocation sources.
• Correlate anomalous process execution with the parent Node.js service using EDR telemetry.

Monitoring Recommendations

• Monitor Node.js hosts for shell spawns, curl, wget, or interpreter launches originating from application PIDs.
• Alert on HTTP request bodies containing $where operator strings destined for API routes.
• Track dependency drift and pin versions in continuous integration to block reintroduction of sift@17.1.3.

How to Mitigate CVE-2026-85625

Immediate Actions Required

• Inventory all applications importing sift and identify version 17.1.3.
• Set the CSP_ENABLED flag in environments where sift cannot be immediately removed, disabling the new Function compilation path.
• Sanitize inbound query objects to strip $where, __proto__, constructor, and prototype keys before passing to sift().
• Freeze Object.prototype at process startup with Object.freeze(Object.prototype) to block pollution primitives.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for sift.js. Review the upstream GitHub Sift.js Repository and GitHub Issue #276 for the current remediation status and any subsequent patched versions.

Workarounds

• Enable the CSP_ENABLED configuration flag to force the non-new Function code path.
• Replace sift with an alternative query engine that does not evaluate string operands as code.
• Wrap sift() calls with a validator that rejects objects whose enumerated keys include operator names inherited from the prototype chain.
• Deploy runtime protections that freeze prototypes and monitor for dynamic code compilation in Node.js workloads.

# Configuration example
export CSP_ENABLED=1
node -e "Object.freeze(Object.prototype); require('./app');"