CVE-2026-117561EUVD-2026-110839GHSA-RJW8-Q97P-7XHF
sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The sf-mcp project, a Salesforce CLI integration server for the Model Context Protocol, is affected by an OS command injection flaw. An attacker who can supply crafted Salesforce CLI flag values can run arbitrary shell commands with the privileges of the MCP server user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- codefriar sf-mcp
through 1.3.2