CVE-2026-16489 | A vulnerability was identified in jsforce up to 3.10.16. Thi… | CVSS 5.3 MEDIUM

Description

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-16489
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-21 15:53 UTC
Published: 2026-07-21 23:30 UTC
Last updated: 2026-07-21 23:30 UTC
Primary CWE: CWE-78
OS Command Injection
Vendor / Product: n/a / jsforce
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
n/a	jsforce	—	3.10.0, 3.10.1, 3.10.2, 3.10.3 …

Weakness (CWE)

CWE	Source	Description
CWE-77	cna	Command Injection
CWE-78	cna	OS Command Injection

CVSS scores (4)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	3.0	cna	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4.8	MEDIUM	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4.3	N/D	2.0	cna	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

References (6)

VDB-380946 | jsforce SFDX Connection Registry sfdx.js _execCommand os command injection https://vuldb.com/vuln/380946
VDB-380946 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/380946/cti
CVE-2026-16489 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-16489
Submit #860031 | Node.js jsforce 3.10.16 OS Command Injection https://vuldb.com/submit/860031
https://github.com/jsforce/jsforce/issues/1805
https://github.com/jsforce/jsforce/