PT-2025-45034 · Salesforce · Salesforce Agentforce Vibes Extension

Published 2025-11-04 · Updated 2025-11-11 · CVE-2025-64321

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Salesforce Agentforce Vibes Extension versions prior to 3.2.0

Description An issue exists in Salesforce Agentforce Vibes Extension related to improper neutralization of input used for LLM prompting, potentially allowing manipulation of writable configuration files.

Recommendations Update Salesforce Agentforce Vibes Extension to version 3.2.0 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-1427

Related Identifiers

CVE-2025-64321

Affected Products

Salesforce Agentforce Vibes Extension

References · 6

• https://osv.dev/vulnerability/CVE-2025-64321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64321 · Security Note
• https://help.salesforce.com/s/articleView?id=005228032&type=1 · Vendor Advisory
• https://t.me/cveNotify/142374 · Telegram Post
• https://help.salesforce.com/s/articleView?id=005228032&type=5 · Note
• https://t.me/CVEtracker/36546 · Telegram Post