CVE-2025-67750

Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machines, CI runners, or editor environments. This issue is fixed in version 6.10.6.

• CWE-94

• https://github.com/Flow-Scanner/lightning-flow-scanner/commit/10f64a5eb193d8a777e453b25e910144e4540795
• https://github.com/Flow-Scanner/lightning-flow-scanner/releases/tag/core-v6.10.6
• https://github.com/Flow-Scanner/lightning-flow-scanner/security/advisories/GHSA-55jh-84jv-8mx8

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67745MyHoard is a daemon for creating, managing and restoring MyS…7.5
• CVE-2025-67746Composer is a dependency manager for PHP. In versions on the…4.3
• CVE-2025-67747Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2025-67748Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2025-67749PCSX2 is a free and open-source PlayStation 2 (PS2) emulator…5.3
• CVE-2025-6775A vulnerability classified as critical has been found in xia…9.8
• CVE-2025-67751ChurchCRM is an open-source church management system. Prior …7.2
• CVE-2025-67752OpenEMR is a free and open source electronic health records …8.1
• CVE-2025-6776A vulnerability classified as critical was found in xiaoyunj…9.8
• CVE-2025-6777A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-67779It was found that the fix addressing CVE-2025-55184 in React…7.5
• CVE-2025-6778A vulnerability, which was classified as problematic, was fo…4.8