CVE-2026-22584

9.8 criticalEPSS 0.4%

Critical (9.8) in salesforce uni2ts. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in uni2ts 2.0.0.

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-01-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

salesforce:uni2ts

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7x99-8x99-xc54	PyPI	uni2ts	<2.0.0	2.0.0
PYSEC-2026-557	PyPI	uni2ts	<2.0.0	2.0.0

References

https://help.salesforce.com/s/articleView?id=005239354&type=1

Check your stack JSON