The flaw in Codefriar sf‑mcp enables an attacker to inject and run arbitrary shell commands by supplying specially crafted Salesforce CLI flag values. The escape routine in src/utils.ts does not neutralize backticks, $() substitutions, or other shell metacharacters, allowing the malicious string to reach execSync in executeSfCommand and execute with the MCP server’s user privileges. This network‑level vulnerability satisfies CWE‑78 and can lead to full control of the machine if the MCP server user is privileged.

Products affected are Codefriar sf‑mcp versions 1.3.2 and earlier. Any instance that relies on the Salesforce CLI and uses the vulnerable flag parsing is at risk. Other Codefriar components or unrelated applications are not impacted.

The CVSS score of 8.5 marks the vulnerability as High severity. EPSS data is not available, and it is not listed in the CISA KEV catalog, suggesting limited wild exploitation to date. The likely attack vector is remote; an attacker only needs to control the flag values sent to the server, no additional authentication beyond normal CLI access. Given the ease of exploitation and potential for immediate remote code execution, the risk remains significant.