Uncontrolled Search Path Element Vulnerability in Salesforce CLI on Windows

CVE-2025-9844

What is CVE-2025-9844?

The vulnerability in Salesforce CLI allows attackers to exploit an uncontrolled search path element on Windows systems, potentially enabling them to replace trusted executables. This imposes significant risks as it can lead to unauthorized code execution. Affected versions include those prior to 2.106.6. It is essential for users to update their Salesforce CLI installation to mitigate this risk and maintain system integrity.

References