CVE-2025-67750: Lightning Flow Scanner Code Injection Vulnerability via Unsafe Use of new Function()
Summary
CVE-2025-67750: Impact The APIVersion rule uses new Function() to evaluate expression strings. Affects lightning-flow-scanner versions < 6.10.6. Fixed in 6.10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Lightning Flow Scanner is an open-source tool designed to analyze and validate flow metadata files in Salesforce applications. It helps developers ensure that their flows adhere to best practices and standards. However, a critical vulnerability has been identified in the APIVersion rule, which utilizes the JavaScript function new Function() to evaluate expression strings. This approach exposes the tool to potential code injection attacks, allowing malicious users to execute arbitrary JavaScript code.
Vulnerability Detail
The vulnerability arises from the use of new Function() within the APIVersion rule, which evaluates user-supplied expression strings. An attacker can craft a malicious flow metadata file that, when scanned, executes arbitrary JavaScript code. This could lead to severe consequences, including unauthorized access to developer machines, CI runners, or editor environments. The vulnerability is classified under CWE-94 (Code Injection) and has a CVSS score of 8.4, indicating a high severity level.
How To Fix
Minimum fixed version
6.10.6
This is the first release that contains the fix.
npm install lightning-flow-scanner@6.10.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, you can implement the following workaround to handle the APIVersion rule separately and avoid unsafe-eval in the core library:
const apiVersionConfig = ruleConfig.rules.APIVersion;
if (apiVersionConfig) {
delete ruleConfig.rules.APIVersion;
}
if (apiVersionConfig) {
const flowApiVer = this.currentFlow.apiVersion || this.currentFlow.xmlData?.apiVersion;
const apiVersionRuleDef = allRules.find(r => r.name === "APIVersion");
let requiredExpr;
if (apiVersionConfig.expression) {
requiredExpr = apiVersionConfig.expression;
} else if (apiVersionConfig.threshold != null) {
requiredExpr = `>=${apiVersionConfig.threshold}`;
}
if (requiredExpr) {
const minVer = parseInt(requiredExpr.replace(/[^0-9]/g, ""), 10);
const operator = requiredExpr.replace(/[0-9]/g, "").trim();
const operators = {
">=": (a, b) => a < b,
"<": (a, b) => a >= b,
">": (a, b) => a <= b,
"<=": (a, b) => a > b,
"==": (a, b) => a !== b,
"=": (a, b) => a !== b
};
const violation = operators[operator] ? operators[operator](flowApiVer, minVer) : flowApiVer < minVer;
if (violation) {
const manualScanResult = [{
flow: parsedFlow,
ruleResults: [{
ruleName: "APIVersion",
ruleDefinition: {
description: apiVersionRuleDef?.description || "API Version check",
label: apiVersionRuleDef?.label || "APIVersion"
},
occurs: true,
severity: apiVersionConfig.severity,
details: [{
name: String(flowApiVer),
type: "apiVersion",
expression: requiredExpr
}]
}]
}];
results.push(...this.processScanResults(manualScanResult));
}
}
}
Conclusion
The CVE-2025-67750 vulnerability in the Lightning Flow Scanner poses a significant risk due to its potential for code injection via the APIVersion rule. It is crucial to update to the patched version 6.10.6 or implement the provided workaround to mitigate this risk. Regular monitoring using tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for lightning-flow-scanner →
FAQ
The Lightning Flow Scanner is a tool used to analyze and validate flow metadata files in Salesforce applications, ensuring they meet best practices.
This vulnerability allows for code injection through the unsafe use of new Function() in the APIVersion rule, enabling attackers to execute arbitrary JavaScript.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If you cannot update the Lightning Flow Scanner, implement the provided workaround to handle the APIVersion rule separately and avoid unsafe-eval.
The vulnerability has a CVSS score of 8.4, indicating a high severity level, which requires prompt attention.
