Junglewise Threat Intelligence

CVE-2025-67750: Lightning Flow Scanner code injection via unsafe Function() in APIVersion rule

CVE-2025-67750 · Severity: low · CVSS 3.1 · Published 2025-12-12

Vendors: npm.

Executive brief

Lightning Flow Scanner is a Salesforce development tool that analyzes flow metadata for best practices and potential issues. The tool's APIVersion rule uses unsafe JavaScript code evaluation (new Function()) to parse version requirements, allowing an attacker to inject and execute arbitrary JavaScript code by crafting a malicious flow metadata file or rule configuration. This could compromise developer machines, CI/CD pipelines, and build environments.

Technical details

The vulnerability is a code injection flaw (CWE-94) in the APIVersion rule that uses new Function() to dynamically evaluate untrusted expression strings provided via flow metadata files or rule configurations. An attacker can craft a malicious Salesforce flow metadata file containing a specially crafted expression (e.g., within rule configuration or flow attributes) that executes arbitrary JavaScript when the scanner processes it. The attack requires the victim to run the scanner on untrusted or attacker-controlled flow metadata, with no authentication or user interaction beyond scanning. A successful exploit allows arbitrary code execution in the context of the scanning process, potentially enabling credential theft, environment variable exfiltration, or lateral movement within CI/CD systems. The patch removes all uses of new Function() and replaces it with a safe expression parser that validates operators (>, >=, <, <=, ==) and performs numeric comparisons without code evaluation.

Affected products

  • Flow-Scanner lightning-flow-scanner <6.10.6
  • Flow-Scanner lightning-flow-scanner-vsx <2.4.4
  • Flow-Scanner lightning-flow-scanner-app <3.1.0

Timeline

  • 2025-12-12: disclosed: GitHub Security Advisory GHSA-55jh-84jv-8mx8 published
  • 2025-12-12: patched: Patches released: core-v6.10.6, vsx-v2.4.4, app-v3.1.0

References