The flaw in sift.js version 17.1.3 allows an attacker to pollute the Object prototype chain with a malicious $where property that is later compiled into executable JavaScript. Because the library iterates over query keys with a for…in loop, it blindly accepts any operator named in the key hierarchy. When CSP_ENABLED is not set, the $where string is compiled by new Function, giving the attacker the ability to run arbitrary JavaScript, potentially compromising server or client runtimes. This is a severe remote code execution vulnerability categorized under CWE-1321.

The affected product is sift.js, a JavaScript library released under the name crcn:sift.js, specifically version 17.1.3. Users running this version in their Node or browser environments are vulnerable. No other versions or products are currently reported to be affected.

The vulnerability has a CVSS score of 9.2, indicating critical severity. The EPSS score of <1% indicates a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. The most likely exploitation route is through any user input that is passed to sift without validation, as the library will immediately execute the $where string. An attacker can also exploit prototype pollution to inject malicious code. Because the attack does not require privileged execution on the host and only needs to supply a crafted query, the risk to systems that expose sift to external inputs is high.