AIKIDO-2026-55673

@salesforce/core is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published Jul 15, 2026

Medium Risk

This Affects:

@salesforce/core

0.16.10 - 8.32.2

Fixed in 8.32.3

Are you affected? Scan for Free

TL;DR

The SfProject.resolveProjectConfig method reads the sfdcLoginUrl and signupTargetLoginUrl fields from a project's sfdx-project.json and returns them for use as the OAuth login endpoint. Before the fix these values are used without validating that the URL is well-formed and points to a Salesforce or internal domain. A crafted project configuration can therefore direct the authentication and token exchange flow to an attacker-controlled host, exposing OAuth credentials or sending requests to unintended endpoints. The fix validates that the configured login URL is syntactically valid and resolves to an allowed Salesforce or internal domain, throwing invalidProjectLoginUrl otherwise.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you authenticate or run commands within a project whose sfdx-project.json originates from an untrusted source.