Salesforce Agentforce & Anypoint Code Builder Arbitrary Command Execution Leading to RCE (CVE-2025-10875, CVE-2025-64320, etc.)

## Vulnerability Key Information ### Vulnerability Description Salesforce Security has identified and resolved vulnerabilities in the "Agentforce Vibes extension" and "MuleSoft Anypoint Code Builder for Desktop" environments. Affected versions include MuleSoft Anypoint Code Builder for Desktop Extension Pack versions prior to 1.11.6 and Agentforce Vibes extension versions prior to 3.2.0. The details of the vulnerabilities are as follows: - **CVE-2025-10875, CVE-2025-64320**: A vulnerability in one of the agent tools allows arbitrary command execution without user approval. When combined with prompt injection, this vulnerability could lead to remote code execution, potentially granting full access to the victim's Salesforce organization. CVSSv4 Score: 9.0 - **CVE-2025-64318, CVE-2025-64321**: Editing special configuration files may allow arbitrary command execution. When combined with prompt injection, this could lead to remote code execution, potentially granting full access to the victim's Salesforce organization. CVSSv4 Score: 9.0 - **CVE-2025-64319, CVE-2025-64322**: Editing special workspace files may allow arbitrary command execution. When combined with prompt injection, this could lead to remote code execution, potentially granting full access to the victim's Salesforce organization. CVSSv4 Score: 9.0 ### Solution The "Agentforce Vibes" and "Anypoint Code Builder - Platform Extension" products require updates to their respective extensions to resolve this issue. Typically, both products automatically retrieve the latest updates and prompt users to apply them by clicking the "Restart Extensions" button in the extensions panel.

Goal Reached Thanks to every supporter — we hit 100%!

Salesforce Agentforce & Anypoint Code Builder Arbitrary Command Execution Leading to RCE (CVE-2025-10875, CVE-2025-64320, etc.)