Sift Js
Monthly
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.