CVE-2025-67750: 
JavaScript vulnerability analysis and mitigation

CVE-2025-67750 is a code injection vulnerability in Lightning Flow Scanner, a CLI plugin, VS Code Extension, and GitHub Action used for analyzing Salesforce Flows. The vulnerability exists in the APIVersion rule, which uses JavaScript's new Function() to evaluate expression strings without sanitization, allowing arbitrary JavaScript execution during a scan. It affects the npm package lightning-flow-scanner versions prior to 6.10.6, the VS Code Extension (VSX) prior to v2.4.4, and the Salesforce App prior to v3.1.0. Disclosed on December 12, 2025, it carries a CVSS v3.1 base score of 8.4 (High) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). In the vulnerable APIVersion.ts rule, the expression option from rule configuration is passed directly into new Function(return ${flowAPIVersionNumber}${options.expression};)(), which evaluates the concatenated string as live JavaScript without any validation or sanitization. An attacker can supply a malicious expression — either via a crafted .flow-meta.xml flow metadata file or through a tampered rule configuration file (e.g., .flow-scanner.yml) — that is then executed in the Node.js process context when a scan is triggered. The fix replaces new Function() with a strict regex-based parser that only accepts whitelisted comparison operators (>, >=, <, <=, ===, !==) followed by a numeric version string (GitHub Commit, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript code with the same privileges as the scanning process, which could be a developer's local machine, a CI/CD runner (e.g., GitHub Actions, Azure DevOps), or a VS Code editor environment. This results in high confidentiality, integrity, and availability impact — an attacker could exfiltrate secrets, credentials, or source code accessible to the process, modify files, install backdoors, or disrupt the development pipeline. The attack vector is local, meaning the attacker must be able to supply a malicious flow metadata file or rule configuration to the target environment, which is realistic in supply chain or repository poisoning scenarios (Github Advisory, GitHub Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.024% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious flow metadata file: Create a Salesforce Flow XML file (.flow-meta.xml) with a crafted apiVersion field, or modify the rule configuration file (.flow-scanner.yml) to inject a malicious expression value for the invalid-api-version / APIVersion rule, such as "; require('child_process').execSync('malicious_command'); //".
2. Place the file in the target repository: Introduce the malicious file into a repository or project directory that is scanned by Lightning Flow Scanner — for example, via a pull request, a supply chain compromise, or direct file system access.
3. Trigger a scan: Wait for or cause the Lightning Flow Scanner to run against the directory containing the malicious file. This can occur automatically in CI/CD pipelines (GitHub Actions, Azure DevOps), when a developer runs sf flow:scan locally, or when the VS Code extension scans on file open/save.
4. Achieve arbitrary code execution: The APIVersion rule reads the expression value and passes it to new Function(), which evaluates the injected JavaScript in the Node.js process context, executing the attacker's payload with the privileges of the scanning process (Github Advisory, GitHub Commit).

• File System: Unexpected or modified .flow-meta.xml files in the repository with unusual apiVersion field values containing JavaScript syntax (e.g., semicolons, parentheses, require, process, exec); tampered .flow-scanner.yml or .flow-scanner.json configuration files with non-standard expression values under the APIVersion rule.
• Process: Unexpected child processes spawned by the Node.js/VS Code process during a scan (e.g., sh, bash, cmd, powershell, curl, wget, python); unusual network connections initiated by the scanner process.
• Logs: CI/CD pipeline logs showing unexpected output or errors during the Lightning Flow Scanner step; Node.js stack traces referencing new Function() evaluation errors in scanner logs.

The primary remediation is to upgrade to the patched versions: lightning-flow-scanner-core v6.10.6 (npm), VS Code Extension v2.4.4, or Salesforce App v3.1.0. The patch removes all uses of new Function() and replaces them with a strict regex-based parser that only accepts whitelisted comparison operators and numeric values. As a temporary workaround, users can manually handle the APIVersion rule in their integration code by removing it from the rule configuration before scanning and implementing a safe numeric comparison themselves, as documented in the security advisory. Additionally, validate and restrict the contents of .flow-scanner.yml and flow metadata files in your repositories, especially in shared or CI/CD environments (Github Advisory, Release Notes).

The vulnerability was discovered by CamilleGuillory and reported by RubenHalman (the project maintainer), who published the advisory and patch on December 12, 2025. The fix was released the same day as the disclosure, demonstrating a rapid response from the maintainer. Coverage has been limited to automated vulnerability tracking platforms and minor security news aggregators, with no significant broader industry commentary identified (Github Advisory).