This vulnerability in jsforce up to version 3.10.16 involves improper handling of input in the _execCommand function of the SFDX Connection Registry, leading to OS command injection. The attack vector is local, requiring the attacker to have local environment access to exploit the flaw. Although an exploit is publicly available, there is no official patch or remediation from the vendor as of the published date. The vulnerability has a CVSS 4.8 score, reflecting a medium level of risk due to the local attack vector and required privileges.

Successful exploitation allows an attacker with local access and low privileges to execute arbitrary operating system commands on the affected system. This can lead to unauthorized actions within the local environment, potentially compromising system integrity or confidentiality depending on the commands executed.

No official fix or patch is currently available for this vulnerability. Since exploitation requires local access, restricting local user permissions and access can reduce risk. Monitor vendor advisories for updates or patches. Avoid running untrusted code or commands in the affected jsforce versions until a remediation is provided.