Lightning Flow Scanner CVE-2025-67750

Exploitation requires that Lightning Flow Scanner (CLI, VS Code extension, or GitHub Action, versions ≤6.10.5) actually scan attacker-influenced input in which the APIVersion rule is active. The concrete sink is the APIVersion rule's options.expression string, which is concatenated into new Function('return <apiVersion><expression>;'); an attacker-controlled expression in the rule configuration (and/or crafted flow metadata) is evaluated as JavaScript. Limiting factors: the APIVersion rule must be configured/invoked, and the attacker must get their malicious config or flow file scanned by the victim (e.g., a CI pipeline auto-scanning an untrusted pull request, or a developer opening a hostile repo with the extension installed). It is a local/host-side execution issue, not a remotely reachable network endpoint, so delivery depends on the victim's scanning workflow rather than direct attacker connectivity.

This is a genuine code-execution flaw (CWE-94) confirmed by the vendor GHSA advisory and the patch commit, which removes the unsafe new Function() call. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) is internally consistent and credible: the vector is LOCAL because exploitation requires the scanner to process an attacker-influenced input file on the host (developer machine, CI runner, or VS Code editor), not a network service. The HIGH C/I/A ratings are justified because arbitrary JavaScript runs in the context of the scanning process. No EPSS score, KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data means real-world exploitation frequency cannot be quantified from this input. The most important nuance the raw CVSS score hides is the delivery constraint: the injected JavaScript flows through the APIVersion rule's expression option (rule configuration) and/or crafted flow metadata, so an attacker must get a malicious repository/config scanned - a realistic supply-chain vector for CI pipelines that auto-scan untrusted pull requests, but a meaningful barrier compared to a remotely reachable service. Net: a real priority for teams running this scanner against untrusted Salesforce flow repos, but the LOCAL vector and niche product footprint temper the absolute risk versus the 8.4 headline.

An attacker submits a pull request (or publishes a repository) containing a malicious Lightning Flow Scanner rule configuration that sets a crafted expression for the APIVersion rule, or a crafted flow metadata file. When a CI runner or a developer's VS Code extension scans the repo, the APIVersion rule passes the attacker-controlled string into new Function(), executing arbitrary JavaScript on the host. No public exploit code was identified in the provided data, though the vulnerable code path is fully disclosed in the patch commit.