Executive brief
jsforce is a library used by developers to integrate JavaScript applications with Salesforce. A security flaw in its command-line interface (CLI) allows a local attacker to execute unauthorized operating system commands on the machine where the tool is running. This could lead to full system compromise, data theft, or the installation of malicious software by exploiting how the tool handles connection names.
Technical details
An OS command injection vulnerability exists in jsforce up to version 3.10.16 within the `_execCommand` function of `lib/registry/sfdx.js`. The root cause is the improper neutralization of shell metacharacters in the `_createCommand` method, which concatenates user-supplied connection names directly into a shell command string for execution via `child_process.exec`. An attacker with local access can exploit this by providing a crafted connection name (e.g., using semicolons or backticks) through the `-c` or `--connection` CLI flags when the `JSFORCE_CONNECTION_REGISTRY` environment variable is set to `sfdx`. This allows for arbitrary code execution with the privileges of the user running the CLI. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- jsforce jsforce up to 3.10.16
Timeline
- 2026-06-16: disclosed: Issue reported to the project maintainers via GitHub issue #1805
- 2026-07-22: advisory: CVE-2026-16489 published