Skip to content
OpenAdvisories

Vendor

codefriar

1 known vulnerabilities.

Products

sf-mcp 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-117561 Public exploit

    sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values

    Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substi…

    codefriar sf-mcp