Sf Mcp
Monthly
OS command injection in Codefriar sf-mcp through 1.3.2 allows an actor who can supply or influence Salesforce CLI tool flag values to run arbitrary shell commands as the MCP server user. The root cause is escapeValue() in src/utils.ts, which leaves backticks, $() substitution and other shell metacharacters intact, so crafted flag values reach execSync inside executeSfCommand. Both the CVSS 4.0 vector and the independent assessment treat the attack vector as local with low privileges and no user interaction, with high confidentiality, integrity and availability impact to the host running the server; no public exploit code is confirmed in the available sources, and the issue is prioritised for remediation this week.
OS command injection in Codefriar sf-mcp through 1.3.2 allows an actor who can supply or influence Salesforce CLI tool flag values to run arbitrary shell commands as the MCP server user. The root cause is escapeValue() in src/utils.ts, which leaves backticks, $() substitution and other shell metacharacters intact, so crafted flag values reach execSync inside executeSfCommand. Both the CVSS 4.0 vector and the independent assessment treat the attack vector as local with low privileges and no user interaction, with high confidentiality, integrity and availability impact to the host running the server; no public exploit code is confirmed in the available sources, and the issue is prioritised for remediation this week.