EUVD-2026-110839
GHSA-rjw8-q97p-7xhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess sf-mcp tool interface
-
DeliverySupply flag value with backticks or $() substitution
-
ExploitescapeValue() fails to neutralize metacharacters
-
ExecutionTainted value reaches execSync in executeSfCommand
-
ImpactArbitrary shell command runs as MCP server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to be able to supply or influence Salesforce CLI tool flag values that sf-mcp passes to the Salesforce CLI - i.e., control over MCP tool input reaching executeSfCommand. The flaw is present in the default escapeValue() behavior of all versions through 1.3.2, so no special non-default configuration is needed once an attacker can inject flag values. Limiting factors: the attack vector is LOCAL (AV:L), not remote/network, and PR:L means the actor needs some privileged or authenticated access to the MCP interface rather than anonymous access; there is no user-interaction requirement (UI:N). Impact is bounded to the privileges of the MCP server user process. |
| Impact | The input CVSS 4.0 score is 8.5 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:N and high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H), no subsequent-system impact. The key risk-dampening signal is the LOCAL attack vector (AV:L) combined with PR:L - an attacker cannot reach this remotely and unauthenticated; they must be able to supply Salesforce CLI flag values into the sf-mcp tool interface, which implies some level of access to or trust within the MCP client/server environment. EPSS is NOT provided in the input, so exploitation probability cannot be quantified. KEV status is absent (not listed by CISA), so there is no confirmed active exploitation. The vuln.today decision label is 'this_week', indicating prompt but not emergency prioritization. SSVC-style reading: exploitation is not confirmed-active; automatability is limited because the trigger requires attacker-controlled flag values rather than an internet-facing default service; technical impact is total for the MCP server user. Net assessment: this is a genuine code-execution flaw worth remediating promptly for anyone running sf-mcp, but the local vector, PR:L requirement, missing EPSS, no KEV listing, and niche single-maintainer product footprint place it below drop-everything emergency status - consistent with the 'this_week' label. Treat as a real priority for sf-mcp operators rather than a widespread mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker who can influence the Salesforce CLI flag values passed to the sf-mcp server (for example through a connected LLM client, a malicious prompt/tool input, or an untrusted upstream feeding the MCP tool) supplies a flag value containing backticks or $() command substitution. Because escapeValue() in src/utils.ts does not neutralize these shell metacharacters, the tainted value reaches execSync in executeSfCommand and the embedded command runs as the MCP server user. A public PoC reference exists (the VulnCheck advisory and GitHub issue #17 document the flaw); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
OS command injection in Codefriar sf-mcp through 1.3.2 allows an actor who can supply or influence Salesforce CLI tool flag values to run arbitrary shell commands as the MCP server user. The root cause is escapeValue() in src/utils.ts, which leaves backticks, $() substitution and other shell metacharacters intact, so crafted flag values reach execSync inside executeSfCommand. Both the CVSS 4.0 vector and the independent assessment treat the attack vector as local with low privileges and no user interaction, with high confidentiality, integrity and availability impact to the host running the server; no public exploit code is confirmed in the available sources, and the issue is prioritised for remediation this week.
RemediationAI
No vendor-released patch or fixed version is identified in the available sources, so upgrading is not yet an actionable fix; track https://github.com/codefriar/sf-mcp/issues/17 and https://www.vulncheck.com/advisories/sf-mcp-through-1.3.2-os-command-injection-via-salesforce-cli-flag-values for a release that stops interpolating flag values into a shell string (or that removes execSync in favour of argument-array execution) before deploying a remediated build. Because exploitation requires the ability to supply or influence Salesforce CLI flag values reaching executeSfCommand, and because the assessed vector is local with low privileges, the practical containment step is to restrict who and what can call the sf-mcp MCP interface and to limit which clients may pass arbitrary flag values, which reduces exposure but does not remove the flaw for permitted callers. The available sources do not document a configuration option that disables the vulnerable pass-through, and the escapeValue() defect is the default behaviour through 1.3.2, so deployments that expose the MCP server to multiple or lower-trust actors should treat command execution as possible under the MCP server user's privileges until a fixed release is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sf-mcp is a Model Context Protocol server that exposes Salesforce CLI operations as MCP tools, so its input surface is the tool arguments an MCP client passes in. Rather than invoking the CLI safely, the code builds a shell command string and hands it to execSync in executeSfCommand, relying on escapeValue() in src/utils.ts (referenced lines 79-90) to neutralise dangerous characters. That routine does not strip backticks, $() command substitution or other shell metacharacters, which is the classic CWE-78 OS command injection failure: data intended as a tool flag value is interpreted by the shell as syntax. The flaw is in the default escaping behaviour of all releases through 1.3.2, so no special non-default configuration is required once an attacker can inject flag values, and any executed command inherits the privileges of the MCP server process user. The CVSS 4.0 vector and the independent CVSS 3.1 assessment both place the attack vector at local (AV:L) with low privileges (PR:L) and no user interaction, and scope the impact to the system hosting the server rather than to downstream systems.
Know when Sf Mcp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local MCP tool input (AV:L), straightforward injection (AC:L), requires ability to supply flag values so PR:L, no scope change, full code execution as server user gives C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
Executive ViewAI
CVE-2026-117561 is a high-severity OS command injection vulnerability in Codefriar sf-mcp (versions up to 1.3.2) that allows a low-privileged local actor to execute arbitrary shell commands as the MCP server user. This puts the confidentiality, integrity, and availability of any host running the sf-mcp server at risk, potentially leading to data theft, system compromise, or service disruption. Leadership should prioritize remediation this week because exploitation could undermine trust in the tooling ecosystem and expose sensitive Salesforce CLI operations.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce input validation to block shell metacharacters, run the MCP server with least privilege in a sandboxed environment, and limit local access to trusted users only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB