Live › vulnerability › CVE-2026-117561
Go to dashboardsf-mcp is a Salesforce MCP server whose escapeValue() function fails to neutralize backticks, $() substitution and other shell metacharacters in CLI flag values. Those values reach execSync, so an attacker can run arbitrary shell commands as the user running the MCP server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that run the sf-mcp server (Codefriar sf-mcp, through 1.3.2) with an MCP client, where the server accepts Salesforce CLI flag values that can be influenced by an attacker, such as prompts or content processed by an AI agent. Teams that do not run sf-mcp can skip it.
No product ranges from the sources yet.
npm ls sf-mcp in the project or global install); versions through 1.3.2 are listed as affected.1.3.2; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-117561")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.