PT-2025-45033 · Salesforce · Salesforce Agentforce Vibes Extension

Published 2025-11-04 · Updated 2025-11-04 · CVE-2025-64320

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Salesforce Agentforce Vibes Extension versions prior to 3.2.0

Description An issue exists in Salesforce Agentforce Vibes Extension related to improper neutralization of input used for LLM prompting, which can lead to code injection. The issue affects the Agentforce Vibes Extension. The vulnerability allows for code injection through manipulation of inputs used in prompts for Large Language Models (LLMs).

Recommendations Update Salesforce Agentforce Vibes Extension to version 3.2.0 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-1427

Related Identifiers

CVE-2025-64320

Affected Products

Salesforce Agentforce Vibes Extension

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-64320 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64320 · Vendor Advisory
• https://help.salesforce.com/s/articleView?id=005228032&type=1 · Vendor Advisory
• https://help.salesforce.com/s/articleView?id=005228032&type=4 · Note
• https://t.me/CVEtracker/36545 · Telegram Post