Salesforce
CVE-2025-64321
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.
AnalysisAI
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.3.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.3.0. Affected products include: Salesforce Agentforce Vibes. Version information: before 3.3.0..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
More in Salesforce
View allVersions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cook
CVE-2024-58258 is a Server-Side Request Forgery (SSRF) vulnerability in SugarCRM's API module that exploits limited code
Salesforce Uni2TS time series forecasting library (through 1.2.0) has a code injection vulnerability that allows leverag
Argument injection in Salesforce Marketing Cloud Engagement CloudPagesURL component. Second Salesforce Marketing Cloud C
Argument injection in Salesforce Marketing Cloud Engagement MicrositeURL component allows command execution. First of fo
Hardcoded cryptographic key in Salesforce Marketing Cloud Engagement used across CloudPages, Forward to a Friend, Profil
Use of broken/risky cryptographic algorithm in Salesforce Marketing Cloud Engagement affecting CloudPages, Forward to a
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component th
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that m
An Improper Neutralization of Argument Delimiters (Argument Injection) vulnerability exists in Salesforce Marketing Clou
A remote code execution vulnerability (CVSS 9.1). Critical severity with potential for significant impact on affected sy
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today