Description
The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker could execute arbitrary JavaScript during a scan by supplying a malicious expression within rule configuration or crafted flow metadata.
Recommendation
Update the lightning-flow-scanner package to the latest compatible version. Followings are version details:
- Affected version(s): < 6.10.6
- Patched version(s): 6.10.6
References
Could your website be exposed too?
SmartScanner can check your website for Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
- bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function - CVE-2025-3194
- TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
You might also like:
See something that needs correcting? Let us knowUpdated February 10, 2026