CVE-2026-34951
Medium
Description
Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Salesforce Workbench
PublishedApr 6, 2026
First seenApr 6, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- salesforce workbench65.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| salesforce workbench | v < 65.0.0 | 65.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.