Skip to content
OS Command Injection Vulnerabilities in Salesforce CLI Tools

OS Command Injection Vulnerabilities in Salesforce CLI Tools

First seen 28 Oct 2026, 06:49 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 07:49 UTC
  • •Two OS Command Injection vulnerabilities identified in Salesforce CLI tools.
  • •Affected tools include Sf MCP (up to version 1.3.2) and Esp MCP (via commit 28afddf).
  • •No active exploitation reported; organizations should monitor for updates.

Two vulnerabilities have been identified in Salesforce CLI tools, both classified as OS Command Injection (CWE-78). The first vulnerability affects versions up to 1.3.2 of the Sf MCP tool, while the second affects the Esp MCP tool through commit 28afddf. These vulnerabilities allow attackers to execute arbitrary commands on affected systems by manipulating command-line flag values and tool parameters. Currently, there is no indication of in the wild, and both issues are disclosed without known patches. Organizations using these tools should assess their exposure and monitor for any updates from Salesforce. The vulnerabilities are part of a broader concern regarding command injection flaws in software tools.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
Vulnerabilities disclosed
Salesforce CLI tools vulnerabilities classified as OS Command Injection were publicly disclosed, affecting multiple versions.
VulnCheck
2026-10-28
Esp MCP vulnerability disclosed
Another OS Command Injection vulnerability was disclosed affecting Esp MCP tool parameters through commit 28afddf.
VulnCheck

More articles in this cluster (2)

Extracted Entities (5)

1 / 4

Common questions

What versions of Salesforce CLI tools are affected?
The Sf MCP tool is affected up to version 1.3.2, and the Esp MCP tool is affected through commit 28afddf.
Is there any active exploitation reported?
No, there are currently no reports of active exploitation for these vulnerabilities.
What should organizations do in response?
Organizations should assess their use of the affected tools and monitor for any updates or patches from Salesforce.