---
id: "CVE-2026-117561"
kind: "vulnerability"
aliases: ["CVE-2026-117561"]
title: "sf-mcp: crafted Salesforce CLI flag values run shell commands as MCP user"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "mcp", "node.js", "salesforce", "sf-mcp"]
not_affected_if: ["sf-mcp-not-installed"]
published_at: "2026-10-27T14:16:38+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117561", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# sf-mcp: crafted Salesforce CLI flag values run shell commands as MCP user

sf-mcp is a Salesforce MCP server whose escapeValue() function fails to neutralize backticks, $() substitution and other shell metacharacters in CLI flag values. Those values reach execSync, so an attacker can run arbitrary shell commands as the user running the MCP server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of sf-mcp (for example `npm ls sf-mcp` in the project or global install); versions through `1.3.2` are listed as affected.
- Look for sf-mcp in MCP client configs (for example Claude Code or Cursor MCP settings) to find where it runs.

## Fix

- Upgrade sf-mcp to a version later than `1.3.2`; the fixed version is unknown from the sources.
- Until patched, remove or disable the sf-mcp server in MCP client configs, or run it only with tool inputs you control.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117561

## From the sources

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_