CVE-2026-16489

Name of the Vulnerable Software and Affected Versions jsforce versions prior to 3.10.17

Description An OS command injection issue exists within the SFDX Connection Registry component. The flaw is located in the execCommand() function within the lib/registry/sfdx.js library. This allows for the execution of arbitrary operating system commands, although the attack can only be performed from a local environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the execCommand() function in the lib/registry/sfdx.js library to minimize the risk of exploitation.