CVE-2026-16489CWE-77CWE-78

jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

Medium · published July 21, 2026

CVSS v4.0
4.8
EPSS
1%
Percentile
64.9
In the wild
Unconfirmed
What it is

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.01083 · 64.9th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-21T23:30Z
EPSS history
Timeline
  • 21 JUL 23:30Z
    jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
    cvelistv5