Salesforce MCP (SOQL Injection)
v0.2.3
Verified
Salesforce CRM integration. WARNING: SOQL injection vulnerability in query builder.
By CommunityMIT
typescript
web services
920stars
24.0Kdownloads
125forks
Scanned Feb 8, 2026
D30%
Scanned 3w ago
Poor Security
Vulnerabilities Found
2Crit
3High
3Med
3Low
4Info
Security ScoreD
30
out of 100
Vulnerabilities Found
2
Crit
3
High
3
Medi
3
Low
4
Info
Last scanned: 2/8/2026
Quality ScoreF
45
out of 100
45
Maint.
42
Popular
45
Docs
48
Compat
Maintenance45%
Popularity42%
Documentation45%
Compatibility48%
Maintenance45
Active
6 days agoCommit Frequency41%
Release Frequency36%
Issue Response44%
Popularity42
920
Stars
24.0K
Downloads
125
Forks
Stars Score54%
Downloads Score62%
Forks Score56%
Documentation45
README Quality78%
Available Documentation
API DocsExamplesChangelog
Compatibility48
MCP Spec Compliance50%
Transport Support50%
Features
TypeScript
Supported Transports
STDIO
Vulnerabilities(15)
2Critical
3High
3Medium
3Low
4Info
Filter:
READMESalesforce MCP (SOQL Injection)
Salesforce MCP
⚠️ SOQL INJECTION VULNERABILITY ⚠️
Issue
Query construction does not sanitize user input, allowing SOQL injection attacks.
Example
Input: x' OR Id != ''
Query becomes: SELECT Id FROM Account WHERE Name = 'x' OR Id != ''
Impact
- Access to unauthorized records
- Data exfiltration
- Business logic bypass
Mitigation
Use parameterized queries with Salesforce Apex binding variables.
Embed Security Badge
Add this badge to your README or documentation
[](https://mcpsafe.org/registry/salesforce-mcp-soql-injection)Need more customization options?Badge Documentation
Server Information
- Source
- NPM
- Package
- salesforce-mcp
- Version
- 0.2.3
- Language
- typescript
- License
- MIT
- Transport
- STDIO
- Added
- Jan 20, 2026
- Updated
- Feb 8, 2026