PT-2026-2212 · Salesforce · Salesforce Uni2Ts

CVE-2026-22584 · Published 2026-01-09 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salesforce Uni2TS versions through 1.2.0

Description An improper control of generation of code issue, specifically a code injection, exists in Salesforce Uni2TS on MacOS, Windows, and Linux. This allows for the leveraging of executable code in non-executable files. The issue could lead to remote code execution by loading malicious model metadata, potentially resulting in a full system takeover.

Recommendations Versions through 1.2.0 should be updated to a newer version that contains a fix for this vulnerability.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-22584

GHSA-7X99-8X99-XC54

PYSEC-2026-557

Affected Products

Salesforce Uni2Ts

References · 18

• https://osv.dev/vulnerability/PYSEC-2026-557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22584 · Security Note
• https://osv.dev/vulnerability/GHSA-7x99-8x99-xc54 · Vendor Advisory
• https://help.salesforce.com/s/articleView?id=005239354&type=1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22584 · Vendor Advisory
• https://github.com/SalesforceAIResearch/uni2ts/commit/7f2d51dd729de018f0f22504f39a8475c6fed1c4 · Note
• https://github.com/SalesforceAIResearch/uni2ts/releases/tag/2.0.0 · Note
• https://github.com/SalesforceAIResearch/uni2ts · Note
• https://github.com/SalesforceAIResearch/uni2ts/pull/218 · Note
• https://github.com/advisories/GHSA-7x99-8x99-xc54 · Note
• https://twitter.com/CVEnew/status/2009751407931371648 · Twitter Post
• https://twitter.com/TheHackerWire/status/2010789807069478973 · Twitter Post
• https://twitter.com/VibeCoderOfek/status/2011079656292712876 · Twitter Post
• https://twitter.com/VibeCoderOfek/status/2011079658763403281 · Twitter Post
• https://twitter.com/OstorlabSec/status/2012177812430434567 · Twitter Post