Description (CNA)
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / jsforce | affected 3.10.0; affected 3.10.1; affected 3.10.2; affected 3.10.3; affected 3.10.4; affected 3.10.5; affected 3.10.6; affected 3.10.7; affected 3.10.8; affected 3.10.9; affected 3.10.10; affected 3.10.11; affected 3.10.12; affected 3.10.13; affected 3.10.14; affected 3.10.15; affected 3.10.16 |
CWE
CWE-78, CWE-77
References
- https://vuldb.com/vuln/380946
- https://vuldb.com/vuln/380946/cti
- https://vuldb.com/cve/CVE-2026-16489
- https://vuldb.com/submit/860031
- https://github.com/jsforce/jsforce/issues/1805
- https://github.com/jsforce/jsforce/
ADP enrichment
No English description supplied.
No references supplied.