Google: remote code execution

### Summary Workbench https://workbench.developerforce.com, a popular open-source Salesforce administration tool (all versions up to 53.0.0), contains critical Remote Code Execution (RCE) and Cross-Site Scripting (XSS) vulnerabilities (assigned CVE-2026-35178). The XSS vulnerability is pre-authentication and can be used to write a malicious cookie. This cookie initializes the RCE exploit, which triggers once an authenticated user accesses specific pages that format timestamps. Furthermore, because Workbench stores users' OAuth tokens in session, attackers can leverage these vulnerabilities to hijack sessions and deploy persistent Apex backdoors to any Salesforce organization managed by the affected administrator. ### Severity CRITICAL #### Motivation This vulnerability is classified as CRITICAL due to the high ease of exploit delivery, the potential for low-privilege escalation, and the catastrophic downstream impact (blast radius). • Pre-authentication Delivery: The Reflected XSS allows exploits to be staged stealthily before a user even authenticates, such as via hidden iFrames. • Low-Privilege Escalation: An attacker with a standard, low-privilege Salesforce trial account can authenticate to a Workbench instance (including the public Developerforce deployment hosting ~200, 000 monthly active users) and exploit the RCE to escalate privileges. • Downstream Compromise: Once RCE is achieved, the attacker can harvest Salesforce OAuth tokens stored in session and deploy per

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-3vq3-92v4-j6mf
• github.com/google/security-research