Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule

Description

The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker could execute arbitrary JavaScript during a scan by supplying a malicious expression within rule configuration or crafted flow metadata.

Recommendation

Update the lightning-flow-scanner package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.10.6
• Patched version(s): 6.10.6

References

• GHSA-55jh-84jv-8mx8
• CVE-2025-67750
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
• React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
• lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd - CVE-2026-4800

You might also like:

Secure Coding 101: How to Use Random Function

How do hackers hack websites?

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

Tags:

npm

lightning-flow-scanner