CVE-2026-117561

sf-mcp CLI flag handling permits host command injection

codefriar · sf-mcp Salesforce CLI MCP server

First documented disclosure · Review checkpoint

Summary

Crafted string flags could cause the MCP server to execute an unintended host command.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe a vulnerability and demonstration, not established malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Flag escaping leaves shell substitutions and other metacharacters meaningful before execSync runs.

Conditions required

Control of arguments passed to an MCP-exposed Salesforce CLI command.

Potential impact

Execution with the server user's permissions, potentially exposing accessible CLI credentials.

Affected versions and configurations

Through 1.3.2.

Fix and mitigation status

No fixed version established in the reviewed sources.

Practical next steps

Disable affected tools until patched; build process argument arrays and validate flag values.

Operating lesson

A quoted CLI argument is not safe if the surrounding shell still interprets it.

Evidence and limits

October 23 is the unchanged public issue date; October 27 is CVE publication. No Salesforce platform compromise is established.

Sources