Salesforce Uni2TS has a Code Injection vulnerability

CRITICAL 9.8CVE-2026-22584 · GHSA-7x99-8x99-xc54 · PYSEC-2026-557 · Published 09/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
uni2ts PyPI	`< 2.0.0`	`2.0.0`
uni2ts salesforce	`< 2.0.0`	`2.0.0`

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-22584 · ADVISORY
SalesforceAIResearch/uni2ts#218 · WEB
SalesforceAIResearch/uni2ts commit 7f2d51d · WEB
SalesforceAIResearch/uni2ts · PACKAGE
SalesforceAIResearch/uni2ts release 2.0.0 · WEB
help.salesforce.com/s/articleView · WEB
pypi.org/project/uni2ts · PACKAGE
GitHub Advisory GHSA-7x99-8x99-xc54 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free