FLOW-CORE-X · CVE-2026-124328 · Package
NO FIX YET · SEE WHAT TO DO
FlowCI flow-core-x up to 1.23.49 passes the condition argument of ConditionManagerImpl.run into Groovy script evaluation without sanitizing it. A remote attacker can inject code that runs on the server, and the exploit is public.
first public Nov 8, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams self-hosting FlowCI flow-core-x (flowci/core) up to 1.23.49 where users can supply a flow condition, which is evaluated as Groovy on the server. VulDB reports it is remotely exploitable with a public proof of concept; whether authentication is required is not stated (the CVSS vector indicates low privileges, PR:L). Teams not running FlowCI can skip it.
Not affected if versions-above-1.23.49
Who cares flow-core-x, flowci, groovy, java, self-hosted
v1.23.01 and VulDB says the vendor did not respond to disclosurePosts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.