Is there a patch available for CVE-2026-34951?

Yes, a patch is available for CVE-2026-34951. Update the affected software to the latest version immediately.

Salesforce CVE-2026-34951

Q: What is the CVSS score of CVE-2026-34951?

CVE-2026-34951 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19357 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 security-advisories@github.com

XSS Salesforce Workbench

5.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

65.0.0

EUVD ID Assigned

Apr 06, 2026 - 16:22 euvd

EUVD-2026-19357

Analysis Generated

Apr 06, 2026 - 16:22 vuln.today

CVE Published

Apr 06, 2026 - 16:16 nvd

MEDIUM 5.1

DescriptionGitHub Advisory

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.

AnalysisAI

Reflected cross-site scripting (XSS) in Salesforce Workbench prior to version 65.0.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the footerScripts parameter on error pages, requiring user interaction to execute malicious payload. The vulnerability stems from improper input sanitization during web page generation. Vendor-released patch: version 65.0.0. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Workbench is a web-based administration and development tool for interacting with Salesforce.com organizations via the Force.com APIs. The vulnerability exists in the error page rendering logic, where the footerScripts parameter is reflected directly into the HTML response without sanitization or encoding. This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-supplied input flows from HTTP request parameter to the DOM without validation or output encoding. The attack surface is the error page handler that processes the footerScripts parameter and renders it as part of the page template.

RemediationAI

Upgrade Salesforce Workbench to version 65.0.0 or later to obtain the patch. This is the primary remediation. As a temporary workaround prior to upgrading, users should avoid clicking on links containing the footerScripts parameter from untrusted sources, and disable JavaScript execution or use a content security policy (CSP) to restrict inline script execution if operationally feasible. For details on the patch and upgrade process, consult the vendor advisory at https://github.com/forceworkbench/forceworkbench/security/advisories/GHSA-j94x-h584-rjf9.