← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-g52w-56c5-674f: Path Containment Omission in Services.resolveWithProjectDirectory() and Tool-Annotation Mismatch in createWebDavTools (SalesforceCommerceCloud/b2c-developer-tooling)

[PUBLISHED BY VENDOR • CVE REQUESTED FROM GITHUB CNA • FIXED IN @salesforce/b2c-dx-mcp@3.9.0 (PR #828)]
Privately reported to SalesforceCommerceCloud/b2c-developer-tooling via GitHub Private Vulnerability Reporting (GHSA-g52w-56c5-674f) covering Path Containment Omission in Services.resolveWithProjectDirectory() and Tool-Annotation Mismatch in createWebDavTools (CWE-22, High 7.1).
Confirmed, patched in merged Pull Request #828 (commit bf85de16ef), and officially published by Salesforce Commerce Cloud maintainer Chris Lavery (@clavery) on 2026-10-28T20:05:05Z with accepted reporter credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-g52w-56c5-674f",
  "repository": "SalesforceCommerceCloud/b2c-developer-tooling",
  "package": "npm:@salesforce/b2c-dx-mcp",
  "html_url": "https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/security/advisories/GHSA-g52w-56c5-674f",
  "fix_pr": "https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/pull/828",
  "fix_commit": "https://github.com/SalesforceCommerceCloud/b2c-developer-tooling/commit/bf85de16ef",
  "state": "published",
  "published_at": "2026-10-28T20:05:05Z",
  "patched_version": "@salesforce/b2c-dx-mcp@3.9.0",
  "cve_request_status": "Requested by maintainer (@clavery) via GitHub CNA on 2026-10-29",
  "summary": "Path Containment Omission in Services.resolveWithProjectDirectory() and Tool-Annotation Mismatch in createWebDavTools",
  "severity": "high",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
  "status": "Published by Vendor (GHSA-g52w-56c5-674f) • CVE Requested • Fixed in @salesforce/b2c-dx-mcp@3.9.0 (PR #828)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-22"
  ]
}