Description

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary shell commands with the privileges of the MCP server process.

INFO

Published Date :

2026-02-11T21:25:57.164Z

Last Modified :

2026-02-12T15:41:13.182Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-26029 vulnerability.

Vendors Products
Akutishevsky
  • Sf-mcp-server
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-26029.

URL Resource
https://github.com/akutishevsky/sf-mcp-server/commit/99fba0171b8c22b5ee3c0405053ccfd2910a066d cve-icon cve-icon
https://github.com/akutishevsky/sf-mcp-server/security/advisories/GHSA-h4w9-g9c5-vfwq cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact