CVE-2025-67750: RCE in lightning-flow-scanner

The core of the vulnerability lies in the APIVersion rule's use of new Function() to evaluate expression strings. This allows an attacker to inject malicious JavaScript code into flow metadata files. When the scanner processes these files, the injected code is executed, granting the attacker control over the scanning process. This could lead to the execution of arbitrary commands on the system running the scanner, potentially allowing for data theft, system compromise, or further malicious activity. The blast radius extends to any environment where the scanner is used, including developer machines, CI/CD runners, and code editor environments, making it a significant security risk.

1. Reserved2025-12-11
2. Published2025-12-12
3. Modified2025-12-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67750 is to upgrade to version 6.10.6 or later of the lightning-flow-scanner component. This version removes the vulnerable new Function() calls and replaces them with a safer parser that validates operators and performs numeric comparisons. If an immediate upgrade is not feasible, consider isolating the scanner from untrusted networks and carefully reviewing all flow metadata files before processing them. While a WAF or proxy cannot directly mitigate this vulnerability, strict input validation on flow metadata files can provide an additional layer of defense. After upgrading, confirm the fix by attempting to scan a flow containing a deliberately crafted malicious expression – it should be rejected by the parser.