CVE-2026-117561

Codefriar sf-mcp (versions through 1.3.2) is vulnerable to OS command injection due to improper neutralization of shell metacharacters. The escapeValue() function in src/utils.ts fails to sanitize backticks, $() substitutions, and other metacharacters, allowing these values to reach execSync in e...