GHSA-7x99-8x99-xc54

Salesforce Uni2TS has a Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-22584

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	uni2ts	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-22584 advisory
https://github.com/SalesforceAIResearch/uni2ts/pull/218 web
https://github.com/SalesforceAIResearch/uni2ts/commit/7f2d51dd729de018f0f22504f39a8475c6fed1c4 web
https://github.com/SalesforceAIResearch/uni2ts package
https://github.com/SalesforceAIResearch/uni2ts/releases/tag/2.0.0 web
https://help.salesforce.com/s/articleView?id=005239354&type=1 web