Description
The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker could execute arbitrary JavaScript during a scan by supplying a malicious expression within rule configuration or crafted flow metadata.
Recommendation
Update the lightning-flow-scanner package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.10.6
- Patched version(s): 6.10.6
References
Could your website be exposed too?
SmartScanner can check your website for Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
- bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function - CVE-2025-3194
- React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
- @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975
You might also like:
See something that needs correcting? Let us knowUpdated February 10, 2026