Repository navigation
Published npm-shrinkwrap.json pins npm@11.19.0 with vulnerable tar@7.5.19 #3642
Description
Summary
Published @salesforce/cli packages include an npm-shrinkwrap.json that pins npm@11.19.0. That npm release bundles tar@7.5.19, which is affected by:
- GHSA-r292-9mhp-454m
- CVE-2026-73566
- Patched in
tar@7.5.21
npm@11.19.1 bundles the fixed tar@7.5.22.
Affected releases
I confirmed the following published CLI releases contain the same vulnerable dependency chain:
@salesforce/cli@2.149.9@salesforce/cli@2.150.6(currentlatest)@salesforce/cli@2.151.6(currentlatest-rc)
Dependency path:
@salesforce/cli
└── npm@11.19.0
└── tar@7.5.19
Consumer impact
Dependabot reports this as a high-severity runtime vulnerability. Consumers cannot cleanly remediate it themselves because the published CLI shrinkwrap dictates the nested npm dependency.
I tested the following approaches:
npm update npm
Root-level npm overrides
Overrides scoped beneath @salesforce/cli
Adding npm@11.19.1 as a direct dependency
Manually updating the consuming repository's package-lock.json
None fixes a clean installation. npm ci follows the CLI's published shrinkwrap and reinstalls npm@11.19.0 and tar@7.5.19. A manual lockfile edit can make dependency scanning appear fixed while leaving the installed package vulnerable.
Requested fix
Please update the CLI's generated shrinkwrap to use npm@11.19.1 or newer and publish a new @salesforce/cli release.
Expected dependency path:
Thank you!
Activity
github-actions commentedon Sep 4, 2026
Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.
github-actions commentedon Sep 4, 2026
Hello @boveus 👋 It looks like you didn't include the full Salesforce CLI version information in your issue.
Please provide the output of
version --verbose --jsonfor the CLI you're using (sforsfdx).A few more things to check:
rcornightlyversions. (docs)doctorcommand to diagnose common issues.Thank you!
boveus commentedon Sep 4, 2026
Releases 2.149.9, 2.150.6, and 2.151.6 pin npm@11.19.0
That npm release bundles vulnerable tar@7.5.19
npm@11.19.1 bundles fixed tar@7.5.22
Consumer overrides and lockfile updates cannot supersede the published npm-shrinkwrap.json
git2gus commentedon Sep 8, 2026
This issue has been linked to a new work item: W-24125144
iowillhoit commentedon Sep 8, 2026
Thanks for reporting this @boveus, I've got a bump merged in oclif/plugin-plugins#1394
This will make it into a
nightlybuild of the CLI soon, however, it will not make it into thelatestversion of the CLI until Sept 30th. We currently have our promotions paused for Dreamforceiowillhoit commentedon Oct 13, 2026
Hey @boveus, this is been released in the
latestversion of the cli. Closing this issue