CVE-2026-85625

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85625", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-04T11:03:33.316Z", "datePublished": "2026-09-04T14:32:15.388Z", "dateUpdated": "2026-09-14T19:33:09.188Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-04T14:32:15.388Z"}, "datePublic": "2026-07-06T00:00:00.000Z", "title": "sift 17.1.3 Prototype Pollution Remote Code Execution via $where", "descriptions": [{"lang": "en", "value": "sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "cweId": "CWE-1321", "type": "CWE"}]}], "affected": [{"vendor": "crcn", "product": "sift.js", "defaultStatus": "unaffected", "packageURL": "pkg:npm/sift", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "17.1.3"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/crcn/sift.js/issues/276", "tags": ["issue-tracking"], "name": "GitHub Issue #276"}, {"url": "https://github.com/crcn/sift.js", "tags": ["product"]}, {"url": "https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: sift 17.1.3 Prototype Pollution Remote Code Execution via $where", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85625", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T19:20:21.665008Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T19:33:09.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85625", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T19:20:21.665008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T19:24:21.251Z"}}], "cna": {"title": "sift 17.1.3 Prototype Pollution Remote Code Execution via $where", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "crcn", "product": "sift.js", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "17.1.3"}], "packageURL": "pkg:npm/sift", "defaultStatus": "unaffected"}], "datePublic": "2026-07-06T00:00:00.000Z", "references": [{"url": "https://github.com/crcn/sift.js/issues/276", "name": "GitHub Issue #276", "tags": ["issue-tracking"]}, {"url": "https://github.com/crcn/sift.js", "tags": ["product"]}, {"url": "https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where", "name": "VulnCheck Advisory: sift 17.1.3 Prototype Pollution Remote Code Execution via $where", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-04T14:32:15.388Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85625", "state": "PUBLISHED", "dateUpdated": "2026-09-14T19:33:09.188Z", "dateReserved": "2026-09-04T11:03:33.316Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-04T14:32:15.388Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/sift", "product": "sift.js", "vendor": "crcn", "versions": [{"lessThanOrEqual": "17.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration."}], "id": "CVE-2026-85625", "lastModified": "2026-09-14T20:16:58.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85625", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T19:20:21.665008Z", "version": "2.0.3"}}]}, "published": "2026-09-04T15:17:42.880", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/crcn/sift.js"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/crcn/sift.js/issues/276"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sift: sift 17.1.3 Prototype Pollution Remote Code Execution via $where", "id": "2533311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533311"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.", "A flaw was found in sift (sift.js). The component's handling of query keys allows for prototype pollution, where an attacker can modify the `Object.prototype.$where` property. This manipulation can lead to arbitrary code execution when benign filter calls are made or when an untrusted query object containing a malicious `$where` string is directly passed to sift."], "name": "CVE-2026-85625", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "impact": "low", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-04T14:32:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85625\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85625\nhttps://github.com/crcn/sift.js\nhttps://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts\nhttps://github.com/crcn/sift.js/issues/276\nhttps://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where"], "statement": "Browser-side exploitation of new Function constructs within sift.js cannot escape the browser sandbox to interact with the underlying RHEL file system, execute shell commands, or compromise the host server.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,17.1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sift.js", "source": "cna", "vendor": "crcn"}, "product": "sift.js", "vendor": "crcn"}], "created": "2026-09-04T15:30:07.020003+00:00", "updated": "2026-09-21T06:15:10.496021+00:00", "vendors": ["crcn", "crcn$PRODUCT$sift.js"]}