19 matches found
CVE-2026-117561
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
CVE-2026-117561 sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
CVE-2026-117561
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
EUVD-2026-110839
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
CVE-2026-117561
Codefriar sf-mcp (versions through 1.3.2) is vulnerable to OS command injection due to improper neutralization of shell metacharacters. The escapeValue() function in src/utils.ts fails to sanitize backticks, $() substitutions, and other metacharacters, allowing these values to reach execSync in e...
CVE-2026-117561 sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
PT-2026-126420
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue in src/utils.ts fails to neutralize backticks, $ substitution, and other shell metacharacters,...
Kevin Poorman Salesforce CLI MCP Server command injection vulnerability
Kevin Poorman: The Salesforce CLI MCP Server versions 1.3.2 and earlier contain a command injection vulnerability. This vulnerability arises because escapeValue fails to neutralize backticks, $, and other shell metacharacters, allowing attackers to supply specially crafted flags for the Salesforc...
CVE-2026-26029
sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of childprocess.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to...
CVE-2026-26029
sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of childprocess.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to...
CVE-2026-26029: Improper Neutralization of Special Elements used in an OS Command
sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of childprocess.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to...
CVE-2025-9844
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6...
CVE-2025-9844
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6...
@flosum/cli (>=0.0.0, <=0.0.5), @flosum/salesforce (>=1.14.10, <=1.17.12-test.18) potentially affected by CVE-2025-9844 via @salesforce/cli (>=2.67.7, <=2.100.4)
@salesforce/cli NPM version =2.67.7, =0.0.0, =1.14.10, =1.17.12-test.18 Source cves: CVE-2025-9844 Source advisory: SNYK:JS-SALESFORCECLI-13011148...
CVE-2025-9844
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6...
CVE-2025-9844
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6...
CVE-2025-9844
The Salesforce CLI on Windows is vulnerable to an Uncontrolled Search Path Element vulnerability in versions prior to 2.106.6 . This flaw allows an attacker to execute arbitrary code by placing a malicious executable in a directory searched before the intended trusted executable, potentially lead...
PT-2025-39170
Name of the Vulnerable Software and Affected Versions Salesforce CLI versions prior to 2.106.6 Description A flaw exists in the Salesforce CLI on Windows that allows for malicious DLL injection due to an uncontrolled search path element. This can lead to the replacement of trusted executables...
CVE-2025-9844: Uncontrolled Search Path Element
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6...