CVE-2026-117561

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...

CVE-2026-117561

Codefriar sf-mcp (versions through 1.3.2) is vulnerable to OS command injection due to improper neutralization of shell metacharacters. The escapeValue() function in src/utils.ts fails to sanitize backticks, $() substitutions, and other metacharacters, allowing these values to reach execSync in e...

CVE-2026-117561 sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...

EUVD-2026-110839

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...

PT-2026-126420

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...