Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule

Description

The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker could execute arbitrary JavaScript during a scan by supplying a malicious expression within rule configuration or crafted flow metadata.

Recommendation

Update the lightning-flow-scanner package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.10.6
• Patched version(s): 6.10.6

References

• GHSA-55jh-84jv-8mx8
• CVE-2025-67750
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975
• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
• TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update - CVE-2025-60542
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571

Tags:

npm

lightning-flow-scanner