CVE-2025-64321 - Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0

Back Back to CVE browser

MEDIUM

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0

Published Nov 4, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0.

Affected products

Vendor Salesforce Product Agentforce Vibes Extension Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Salesforce

Agentforce Vibes Extension

unaffected

Version	Status	Constraints
0	affected	<3.3.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1427

CWE-94

Code Injection

References (1)

https://help.salesforce.com/s/articleView?id=005228032&type=1
Vendor Advisory

Link	Providers	Tags
https://help.salesforce.com/s/articleView?id=005228032&type=1		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Salesforce

Published Nov 4, 2025

Updated Nov 11, 2025

Reserved Oct 30, 2025

Link CVE-2025-64321

CISA Vulnrichment

Updated Nov 5, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-64321

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-64321