A code injection vulnerability in the Lightning Flow Scanner tool allows unauthenticated attackers to execute arbitrary JavaScript on developer machines, CI runners, or editor environments.

The application utilizes the new Function() constructor to evaluate expression strings within the APIVersion rule, which fails to sanitize input, allowing an attacker to inject and execute malicious code via crafted flow metadata files. This flaw is triggered without requiring authentication from the user performing the scan.

Successful exploitation allows an attacker to achieve arbitrary code execution within the context of the environment where the scanner is running. This poses a significant risk to developer workstations, build servers, and continuous integration pipelines, potentially leading to unauthorized data exfiltration, source code theft, or the compromise of deployment credentials. Given the high CVSS score of 8.4, this vulnerability represents a severe risk to the integrity and confidentiality of the development lifecycle.

Immediate Action: Update the lightning-flow-scanner package to version 6.10.6 or later immediately to resolve the vulnerable use of the new Function() constructor.

Proactive Monitoring: Review logs for unusual execution patterns or unexpected file access occurring during the flow scanning process in CI/CD pipelines.

Compensating Controls: Restrict the execution of the flow scanner to isolated, non-privileged environments or containerized runners to minimize the potential impact of a successful host compromise.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a critical risk to software supply chain integrity by targeting the tools used to optimize Salesforce flows. Administrators must prioritize updating all instances of lightning-flow-scanner to version 6.10.6 across developer machines and build infrastructure. Failure to patch may allow attackers to compromise the security of the entire development ecosystem through simple metadata manipulation.