sf-mcp vulnerabilities

CVEs whose affected-version data names the sf-mcp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117561High· 7.8

1w ago

sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize…

▾ Twilightcodefriar · sf-mcpvia CVEORG