CVE-2026-117561: sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to supply crafted values for Salesforce CLI tool flags to the sf-mcp MCP server. The injected commands execute with the privileges of the user running that server.
Which releases are affected?
sf-mcp versions through 1.3.2 are affected.
What input patterns make exploitation possible?
Flag values containing shell metacharacters that are not neutralized by escapeValue(), including backticks and $() command substitution, can reach execSync and be interpreted by the shell.