CVE-2025-10875: salesforce mulesoft_anypoint_code_builder

Vulnerability summary

CVE-2025-10875 is a medium (CVSS 6.5) vulnerability in salesforce mulesoft_anypoint_code_builder. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11% of scored vulnerabilities.

Timeline

1. 04-11-2025
   PublishedVulnerability first disclosed.
2. 05-11-2025
   Last modifiedVulnerability information updated.

Description

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Code Builder: before 1.11.6.

• CWE-1427Improper Neutralization of Input Used for LLM PromptingThe product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.