Description
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| codefriar | sf-mcp | ≤ 1.3.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
AlexBiller/salesforce-cve-remediation-demo ★ 0 · Nov 2, 2026
Unofficial demo built with Devin - synthetic data: CVE-2026-117561 command-injection remediation walkthrough
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Issue #17 issue-tracking
- https://github.com/codefriar/sf-mcp product
- https://github.com/codefriar/sf-mcp/blob/beb103dced68962e0c069b62cb377286751d0103/src/utils.ts#L79-L90 technical-description
- VulnCheck Advisory: sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values third-party-advisory