The vulnerability resides in the _execCommand function of jsforce's SFDX Connection Registry and permits an attacker to inject arbitrary operating‑system shell commands. When an attacker manipulates the input to this function, the injected command is executed with the privileges of the running process, potentially allowing full local system compromise. The weakness is characterized by CWE‑77 and CWE‑78, and the CVSS score of 4.8 indicates a moderate severity. TheISA KEV catalog; the EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild.

All installations of the jsforce JavaScript library up to and including version 3.10.16 are affected. The vulnerable code resides the SFDX Connection Registry component. Users who rely on this library for Salesforce integration or SFDX CLI interactions are at risk. No specific vendor patches are listed, and the project has yet to provide an official fix.

Although the attack vector is limited to a local environment, the ability to execute arbitrary commands elevates the risk to potential system compromise or data exfiltration if the library runs with elevated privileges. The moderate CVSS score, combined with the very low EPSS score and absence from the KEV catalog, suggest that while the flaw is serious, it is unlikely to see widespread exploitation yet. Nonetheless, the presence of a publicly available exploit means that any system running a vulnerable jsforce version in a local context should consider immediate remediation or mitigation.