Description
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jsforce | 3.10.0, 3.10.1, 3.10.2, 3.10.3, 3.10.4, 3.10.5, 3.10.6, 3.10.7, 3.10.8, 3.10.9, 3.10.10, 3.10.11, 3.10.12, 3.10.13, 3.10.14, 3.10.15, 3.10.16 | — |
References
- VDB-380946 | jsforce SFDX Connection Registry sfdx.js _execCommand os command injection vdb-entry technical-description
- VDB-380946 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-16489 | CVE Analysis and Report third-party-advisory
- Submit #860031 | Node.js jsforce 3.10.16 OS Command Injection third-party-advisory
- https://github.com/jsforce/jsforce/issues/1805 exploit issue-tracking
- https://github.com/jsforce/jsforce/ product