Introduction
Attackers can exploit misconfigured search paths in widely used enterprise tools to run malicious code with elevated privileges. Salesforce recently disclosed a high-severity vulnerability in Salesforce CLI, a command-line tool essential to Salesforce developers and administrators. On Windows, it lets a local attacker replace trusted executables and potentially compromise sensitive environments.
Salesforce sells cloud-based CRM and business automation software to more than 150,000 organizations. Its CLI is a core tool for managing, deploying, and automating Salesforce environments, so any vulnerability in it has a wide impact on enterprises worldwide.
Technical information
CVE-2025-9844 is a high-severity vulnerability (CVSS 8.8) classified as CWE-427: Uncontrolled Search Path Element. It affects Salesforce CLI for Windows in all versions before 2.106.6. The CLI does not properly validate or control the search path it uses to locate and load external executables or resources.
When Salesforce CLI invokes an external program or loads a dynamic library without an absolute path, Windows looks for the file in a fixed order: the application directory, the system directories, the current working directory, and then the directories listed in the PATH environment variable. If an attacker can write a malicious executable with the same name as a legitimate one into a directory that Windows searches first, the CLI may run the attacker's code instead of the intended program. This technique is commonly called DLL hijacking or binary planting.
The root cause is that the CLI invokes external executables without full paths and relies on the Windows search order to find them. An attacker with local access (but not necessarily administrative privileges) can use this to run code in the context of the user running the CLI.
No public code snippets or specific vulnerable functions have been disclosed for this issue.
Affected systems and versions
- Salesforce CLI for Windows
- All versions before 2.106.6 are affected
- Only Windows installations are vulnerable
- No evidence of exploitation on other operating systems
Vendor security history
Salesforce has had several notable vulnerabilities in 2025, including multiple CVEs in Salesforce Industry Cloud products. The company generally works with security researchers and issues timely advisories and patches. Critical vulnerabilities keep recurring, though, including configuration and path-handling issues, which points to ongoing problems in its secure development and testing practices.
