https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T11:05:03.831741+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-117561 CVE-2026-117561 — sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values 2026-10-29T11:05:03.835306+00:00

Affected: codefriar sf-mcp

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.