High · published December 13, 2025
⚡ A crafty flow metadata file is all it takes to unleash JavaScript execution during scanning! This vulnerability means your developer environment could be compromised just by checking a file. 🛠️ Think of it like a chef receiving a dish that looks perfectly fine but contains a hidden ingredient that causes chaos in the kitchen — one wrong recipe can spoil the whole meal! 🍽️ An attacker could sneak a malicious expression into the flow metadata, allowing arbitrary code execution on your developer machines or CI runners. This could lead to serious breaches, with attackers gaining control over environments that should be secure. Scary, right?
Think of it like a chef receiving a dish that looks perfectly fine but contains a hidden ingredient that causes chaos in the kitchen — one wrong recipe can spoil the whole meal! 🍽️ This vulnerability in versions 6.10.5 and below of Lightning Flow Scanner allows malicious code execution via crafted flow metadata due to the use of new Function() in the APIVersion rule. This means untrusted code can run, compromising your systems.
An attacker could sneak a malicious expression into the flow metadata, allowing arbitrary code execution on your developer machines or CI runners. This could lead to serious breaches, with attackers gaining control over environments that should be secure. Scary, right? Update Lightning Flow Scanner to version 6.10.6 immediately to close this security gap! Also, review your flow metadata files for any suspicious activity and ensure your CI runners are properly secured. You've got this! Patch your systems and keep your development environment safe! 🛡️