Salesforce Uni2TS has a Code Injection vulnerability

The impact of this Code Injection vulnerability is significant. An attacker could leverage this flaw to execute arbitrary code on the affected system with the privileges of the Uni2TS process. This could lead to data theft, system takeover, and lateral movement within the network. The ability to inject code into non-executable files bypasses typical security controls, making exploitation more likely. Successful exploitation could grant an attacker persistent access and control over the compromised system, potentially impacting sensitive Salesforce data and infrastructure.

Organizations using Salesforce Uni2TS for data migration or integration processes, particularly those running older versions (≤1.2.0) on MacOS, Windows, or Linux systems, are at significant risk. Shared hosting environments where multiple users share the same Uni2TS installation are also particularly vulnerable.

• python / server:

import os
import hashlib

def check_uni2ts_version(path):
    try:
        with open(path, 'r') as f:
            version_line = f.readline().strip()
            version = float(version_line.split('=')[1].strip()) #Assumes version is in a line like version = 1.2.0
            return version
    except (FileNotFoundError, ValueError, IndexError):
        return None

uni2ts_path = '/path/to/uni2ts' # Replace with actual path
version = check_uni2ts_version(uni2ts_path)
if version and version <= 1.2.0:
    print(f"Uni2TS version is vulnerable: {version}")
else:
    print("Uni2TS version is not vulnerable or version check failed.")

• linux / server:

find / -name "uni2ts" -type f -print0 | xargs -0 ls -l | grep "<= 1.2.0"

• generic web: Inspect file permissions on Uni2TS executables and related files. Look for any files with executable permissions that should not have them.

1. 2026-01-10Disclosure

   disclosure

2. 2026-01-10Patch

   patch

1. आरक्षित2026-01-07
2. प्रकाशित2026-01-10
3. संशोधित2026-02-03
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-22584 is to upgrade Salesforce Uni2TS to version 2.0.0 or later, which contains the fix. If an immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing strict file access controls to prevent unauthorized modification of non-executable files. Monitor system logs for suspicious activity related to Uni2TS processes. While a WAF is unlikely to directly mitigate this vulnerability, network segmentation can limit the blast radius of a successful attack. After upgrading, confirm the fix by attempting to trigger the vulnerability and verifying that the code injection is prevented.