CVE-2026-16489 jsforce CVE debrief

Who should care

Users of jsforce up to 3.10.16 should assess their exposure and consider updating to a patched version. Operators, platform administrators, vulnerability management teams, and security teams may be impacted by this vulnerability.

Technical summary

The vulnerability, CVE-2026-16489, is a low-severity issue with a CVSS score of 1.9. It allows for OS command injection through the _execCommand function in lib/registry/sfdx.js. Exploitation requires local access, and the attack can only be performed from a local environment. The vulnerability affects jsforce up to 3.10.16. Users should assess their exposure and consider updating to a patched version. The project was informed of the problem early through an issue report but has not responded yet. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Defensive priority

Low priority due to local attack vector and low CVSS score.

Recommended defensive actions

• Inventory and assess jsforce installations up to 3.10.16
• Consider updating to a patched version of jsforce
• Monitor for local exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-22T00:17:30.887Z and was last modified on 2026-07-22T16:25:46.380Z. The NVD entry is currently Deferred. The vulnerability affects jsforce up to 3.10.16, and the attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.