CVE-2026-16489 — jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Regist…
Published: 2026-07-21 · CVSS: 4.8 · CVSS 4.0
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7