PT-2025-50977 · Microsoft+2 · Vs Code Extension+2

Published 2025-12-12 · Updated 2025-12-13 · CVE-2025-67750

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lightning Flow Scanner versions 6.10.5 and below

Description Lightning Flow Scanner, a CLI plugin, VS Code Extension, and GitHub Action for Salesforce Flow analysis and optimization, is affected by an issue where maliciously crafted flow metadata files can lead to arbitrary JavaScript execution during scanning. The APIVersion rule utilizes new Function() to evaluate expression strings, allowing an attacker to inject a malicious expression within rule configuration or crafted flow metadata. This could potentially compromise developer machines, CI runners, or editor environments.

Recommendations Update to version 6.10.6 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-67750

GHSA-55JH-84JV-8MX8

Affected Products

Github Actions

Lightning-Flow-Scanner

Vs Code Extension

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67750.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67750 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67750 · Vendor Advisory
• https://github.com/Flow-Scanner/lightning-flow-scanner/releases/tag/core-v6.10.6 · Note
• https://github.com/Flow-Scanner/lightning-flow-scanner/security/advisories/GHSA-55jh-84jv-8mx8 · Note
• https://github.com/Flow-Scanner/lightning-flow-scanner/commit/10f64a5eb193d8a777e453b25e910144e4540795 · Note
• https://twitter.com/VulmonFeeds/status/1999662474178576581 · Twitter Post
• https://twitter.com/CVEnew/status/1999876833546764740 · Twitter Post
• https://t.me/CVEtracker/39669 · Telegram Post
• https://twitter.com/TheHackerWire/status/1999690575210324321 · Twitter Post