Codefriar sf-mcp: OS command injection via Salesforce CLI flags (CVE-2026-117561)
The sf-mcp package through version 1.3.2 is vulnerable to OS command injection due to insufficient sanitization of Salesforce CLI flag values in the escapeValue function, allowing remote code execution.
CVE search metadata
CVE search record: CVE-2026-117561. Severity: high. CVSS: 7.8. KEV: no. Product: sf-mcp (<= 1.3.2). Brief: Codefriar sf-mcp: OS command injection via Salesforce CLI flags (CVE-2026-117561). Brief link: https://feed.craftedsignal.io/briefs/2026-10-codefriar-sf-mcp-rce/
Triage facts
Revision 1- Applicability
- sf-mcp (<= 1.3.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Codefriar sf-mcp contains an OS command injection vulnerability in the escapeValue() function within src/utils.ts. The application fails to properly neutralize shell metacharacters, including backticks and $() substitution, when processing flags for the Salesforce CLI. These unsanitized values are subsequently passed to execSync in executeSfCommand, leading to arbitrary command execution as the user running the MCP server process.
Impact
An attacker can execute arbitrary shell commands with the privileges of the user running the MCP server, potentially leading to unauthorized data access, system modification, or further lateral movement within the environment.
Recommendation
- Update the
sf-mcppackage to a version beyond 1.3.2 to remediate the vulnerability insrc/utils.ts. - Review logs for the MCP server process for unexpected child processes or unusual command-line arguments involving Salesforce CLI flags.
- Audit environments running
sf-mcpto ensure the process runs with the principle of least privilege, minimizing the impact of potential command execution.
Immediate actions
Upgrade sf-mcp to a version higher than 1.3.2.
Threat Hunt
Identify MCP server processes spawning unexpected sub-processes or utilizing complex shell metacharacters in command-line arguments.
Data: Process creation logs (ParentProcessName, CommandLine, ProcessName)
Mitigations
Upgrade sf-mcp to a version later than 1.3.2.
CVE-2026-117561