Lightning Flow Scanner Vulnérable à l'Injection de Code via une Utilisation Non Sécurisée de `new Function()` dans la Règle APIVersion

The core of the vulnerability lies in the APIVersion rule's use of new Function() to evaluate expression strings. This allows an attacker to inject malicious JavaScript code into flow metadata files. When the scanner processes these files, the injected code is executed, granting the attacker control over the scanning process. This could lead to the execution of arbitrary commands on the system running the scanner, potentially allowing for data theft, system compromise, or further malicious activity. The blast radius extends to any environment where the scanner is used, including developer machines, CI/CD runners, and code editor environments, making it a significant security risk.

Developers using lightning-flow-scanner in their development workflows are at significant risk. This includes teams utilizing CI/CD pipelines that incorporate the scanner, as well as developers using code editors or IDEs that integrate with the component. Shared hosting environments where multiple developers share the same instance of the scanner are particularly vulnerable.

• nodejs: Monitor process execution for unusual JavaScript activity. Use ps aux | grep node to identify running instances of lightning-flow-scanner. Examine the command-line arguments for suspicious flow metadata files. • nodejs: Inspect the lightning-flow-scanner module's source code for the presence of new Function() calls, particularly within the APIVersion rule. • generic web: If the scanner is exposed via a web interface, monitor access logs for requests containing unusual or malformed flow metadata. Look for POST requests to endpoints that process flow files. • generic web: Check for unexpected JavaScript execution in the browser's developer console when interacting with the scanner's web interface.

1. 2025-12-12Disclosure

   disclosure

1. Réservé2025-12-11
2. Publiée2025-12-12
3. Modifiée2025-12-20
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-67750 is to upgrade to version 6.10.6 or later of the lightning-flow-scanner component. This version removes the vulnerable new Function() calls and replaces them with a safer parser that validates operators and performs numeric comparisons. If an immediate upgrade is not feasible, consider isolating the scanner from untrusted networks and carefully reviewing all flow metadata files before processing them. While a WAF or proxy cannot directly mitigate this vulnerability, strict input validation on flow metadata files can provide an additional layer of defense. After upgrading, confirm the fix by attempting to scan a flow containing a deliberately crafted malicious expression – it should be rejected by the parser.