Codefriar sf-mcp: OS command injection via Salesforce CLI flag values
Summary
sf-mcp through version 1.3.2 is a Model Context Protocol server that wraps the Salesforce CLI for LLM tools such as Claude Desktop. Flag values are not properly escaped, so backticks, $() substitution and other shell metacharacters reach execSync and run as the MCP server user. An attacker who can supply crafted input, for example through prompt injection or a malicious MCP client, can execute arbitrary shell commands with access to the stored Salesforce CLI credentials and org data.
Affected
- codefriar sf-mcp versions 0 to 1.3.2 (per CVE record)
- Vulnerable function: escapeValue() in src/utils.ts, used by executeSfCommand
Fixed in
Unknown. No fixed version or vendor advisory was found at the time of research.
Workaround
- No vendor-supplied workaround found.
- Disable or remove the server on systems that do not need it.
- Run the server under a dedicated low-privilege OS account.
- Use a Salesforce user with minimal permissions and short-lived tokens; do not reuse admin credentials.
- Allow only trusted MCP clients and servers and review AI agent tool calls before approval.
Exploitation
- Public write-ups and a detailed GitHub issue describe the flaw.
- Not known to be exploited in the wild (as of 27 Oct 2026).
- Not listed in CISA KEV. EPSS score is 0.65 percent.
Our recommendation
- Check whether sf-mcp is installed on developer workstations or servers and who uses it.
- Remove or disable it where it is not needed; do not run it on shared or unattended hosts.
- Restrict its Salesforce access to least privilege and rotate credentials if misuse is suspected.
- Confirm the transport is local stdio and not exposed via an SSE or HTTP wrapper.
- Monitor the repository for a fix and plan an alternative if none appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record mirror (NVD) vulners.com
- VulnCheck advisory www.vulncheck.com
- GitHub security issue #17 github.com
- Vulnerable code at commit beb103d github.com
- Project repository github.com
- OffSeq threat radar entry radar.offseq.com
- Strix CVE page www.strix.ai
- npm package sf-mcp www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:01.
Original description (NVD)
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.