Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new Function() to evaluate expression strings, enabling an attacker to supply a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machines, CI runners, or editor environments. This issue is fixed in version 6.10.6.

Affected: npm: lightning-flow-scanner

### Impact The APIVersion rule uses `new Function()` to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker could execute arbitrary JavaScript during a scan by supplying a malicious expression within rule configuration or crafted flow metadata. This could compromise developer machines, CI runners, or editor environments.

### Patches The patch removes all uses of `new Function()` and replaces them with a safer parser. It now validates operators (`>`, >=`, `<`, `<=`, `==`) and performs numeric comparisons without evaluating untrusted JavaScript.

**version:** core-v6.10.6, **version vsx:**: v2.4.4 **version app:**: v3.1.0

### Work around

``` // --- Handle APIVersion rule separately to avoid unsafe-eval in the core library --- const apiVersionConfig = ruleConfig.rules.APIVersion; if (apiVersionConfig) { delete ruleConfig.rules.APIVersion; }

// Manually evaluate the APIVersion rule, if it was configured. if (apiVersionConfig) { const flowApiVer = this.currentFlow.apiVersion || this.currentFlow.xmlData?.apiVersion; const apiVersionRuleDef = allRules.find(r => r.name === "APIVersion");

// Determine the required expression (e.g. ">=58"). let requiredExpr; if (apiVersionConfig.expression) { requiredExpr = apiVersionConfig.expression; } else if (apiVersionConfig.threshold != null) { requiredExpr…