CVE-2026-117561 in sf-mcp
Summary
by MITRE • 10/27/2026
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Codefriar sf-mcp versions through 1.3.2 represents a critical OS command injection flaw rooted in insufficient input validation within the application's utility layer. This security defect allows remote attackers to execute arbitrary shell commands on the host system by manipulating specific flag values passed to the Salesforce CLI tool integration. The core of the issue lies in the implementation of the escapeValue function located in src/utils.ts, which is responsible for sanitizing user-supplied input before it is processed further by the application logic. Despite its intended purpose as a security control, this function fails to properly neutralize dangerous shell metacharacters such as backticks and command substitution sequences like $(). This failure creates a direct pathway for malicious payloads to bypass existing safeguards and interact with the underlying operating system's command interpreter.
From a technical perspective, the vulnerability manifests when crafted flag values are supplied by an attacker. These values traverse through the application stack until they reach the executeSfCommand function, which utilizes Node.js execSync to run shell commands. Because the escapeValue function does not filter out characters that have special meaning in POSIX-compliant shells, these metacharacters remain intact within the command string passed to execSync. Consequently, when the system executes the command, it interprets the injected sequences as valid shell instructions rather than literal data strings. This allows an attacker to chain commands, access sensitive files, or execute arbitrary programs with the privileges of the user account running the MCP server process. The lack of proper escaping for backticks and $() substitution is particularly dangerous because these constructs are commonly used in shell scripting to capture command output and perform nested executions, respectively.
The operational impact of this vulnerability is severe, as it effectively grants an attacker full control over the host system depending on the execution context of the MCP server. If the service runs with elevated privileges or access to sensitive data stores, the consequences can include complete system compromise, unauthorized data exfiltration, and lateral movement within the network environment. Attackers could potentially use this entry point to establish persistence mechanisms, install backdoors, or disrupt critical business operations by terminating essential services. The vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, which highlights the failure to properly sanitize user input before inclusion in system commands. Additionally, from a tactical perspective aligned with MITRE ATT&CK frameworks, this flaw facilitates techniques related to Command and Scripting Interpreter abuse, allowing adversaries to execute operating system commands directly through application interfaces rather than traditional network-based attack vectors.
To mitigate this vulnerability, immediate remediation efforts should focus on hardening the input validation logic within the escapeValue function in src/utils.ts. Developers must implement a whitelist approach for allowed characters or employ robust escaping mechanisms that specifically address shell metacharacters including backticks, dollar signs with parentheses, semicolons, and pipe operators. It is also recommended to replace the use of execSync with safer alternatives such as spawn functions from child_process modules where possible, as these allow better control over argument parsing and reduce the risk of command injection by separating commands from their arguments more strictly. Furthermore, applying principle of least privilege to the MCP server user account can limit the blast radius in case a successful exploitation occurs. Organizations should also consider implementing runtime application self-protection measures or web application firewalls that detect anomalous shell command patterns to provide an additional layer of defense against such injection attempts.