The flaw in sift.js version 17.1.3 allows an attacker to pollute the Object prototype chain to inject a malicious $where property that is later compiled into executable code. Because the library iterates over query keys with a for…in loop, it blindly accepts any operator named in the key hierarchy. When CSP_ENABLED is not set, the $where value is turned into a Function via new Function, giving the attacker the ability to run arbitrary JavaScript, which can compromise the server or client runtime. This is a severe remote code execution vulnerability categorized under CWE-1321.

The affected product is sift.js, a JavaScript library released under the name crcn:sift.js, specifically version 17.1.3. Users running this version in their Node or browser environments are vulnerable. No other versions or products are currently reported to be affected.

The vulnerability has a CVSS score of 9.2, indicating critical severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. The most likely exploitation route is through any user input that is passed to sift without validation, as the library will immediately execute the $where string. An attacker can also exploit manufacturer pollution to inject malicious code. Because the attack does not require privileged execution on the host and only needs to supply a crafted query, the risk to systems that expose sift to external inputs is high.