{"id":"CVE-2026-124328","kind":"vulnerability","aliases":["CVE-2026-124328"],"related":[],"title":"FlowCI flow-core-x: condition argument lets remote users inject code","description":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"FlowCI flow-core-x up to 1.23.49 passes the condition argument of ConditionManagerImpl.run into Groovy script evaluation without sanitizing it. A remote attacker can inject code that runs on the server, and the exploit is public.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"flow-core-x","fixed":[],"affected":"<= 1.23.49","ecosystem":"maven"}],"ecosystems":[],"tags":["flow-core-x","flowci","groovy","java","package","self-hosted"],"not_affected_if":["versions-above-1.23.49"],"how_to_check":"- Check your flow-core-x / flowci/core version; every release up to 1.23.49 is listed as affected by VulDB (the vendor has not published a fixed version).\n- FlowCI evaluates the flow-level 'condition' (Groovy) in ConditionManagerImpl.run. Review which users can create or edit flows/YAML with a condition, and review existing flows for unexpected Groovy in condition fields.","fix":"No fixed version known. The FlowCI releases page lists no release after v1.23.01 and VulDB says the vendor did not respond to disclosure.","status":"open","published_at":"2026-11-08T11:16:34+00:00","first_seen_at":"2026-11-08T11:47:27+00:00","triaged_at":"2026-11-08T11:48:52+00:00","updated_at":"2026-11-08T11:50:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T11:48:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FlowCI flow-core-x: condition argument lets remote users inject code","impact":"high","summary":"FlowCI flow-core-x up to 1.23.49 passes the condition argument of ConditionManagerImpl.run into Groovy script evaluation without sanitizing it. A remote attacker can inject code that runs on the server, and the exploit is public.","audience":"businesses","category":"package","nicknames":[],"who_cares":["flowci","flow-core-x","groovy","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the CI server","analyst_note":"Confirm whether a fixed version exists and whether authentication is required; check NVD and the vendor repository for a patch.","how_to_check":"- Check the installed flow-core-x version against `1.23.49` or lower.\n- Look for the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java in your deployment.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-above-1.23.49"],"who_is_affected":"Teams running FlowCI flow-core-x up to version 1.23.49 where pipeline conditions are evaluated; the flaw is reachable remotely according to the report. The sources do not say whether authentication is required or whether any non-default setting is needed. The vendor did not respond to early disclosure, so no patch is confirmed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4619,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists and whether authentication is required; check NVD and the vendor repository for a patch.","search":"'-124328':15A,18A '-2026':14A,17A '1.23.49':41B,84C 'affect':86C 'argument':7A,45B,106C 'attack':57B,113C 'carri':118C 'code':12A,60B,110C 'compon':98C 'condit':6A,44B,107C 'conditionmanagerimpl.run':47B,91C 'contact':136C 'core':4A,21A,25B,37B,80C 'core/src/main/java/com/flowci/core/common/manager/conditionmanagerimpl.java':95C 'cve':13A,16A 'disclos':125C 'disclosur':140C 'earli':137C 'element':87C 'evalu':51B,101C 'exploit':68B,122C 'file':94C 'flow':3A,20A,24B,36B,79C 'flow-core-x':2A,19A,23B,35B,78C 'flowci':1A,27B,34B,77C 'found':75C 'function':90C 'groovi':28B,49B,99C 'host':33B 'inject':11A,59B,111C 'java':29B 'lead':108C 'let':8A 'manipul':103C 'may':130C 'packag':30B 'pass':42B 'possibl':115C 'public':70B,128C 'remot':9A,56B,120C 'respond':144C 'run':62B 'sanit':53B 'script':50B,100C 'self':32B 'self-host':31B 'server':65B 'use':132C 'user':10A 'vendor':134C 'vulner':72C 'way':147C 'without':52B 'x':5A,22A,26B,38B,81C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting FlowCI flow-core-x (flowci/core) up to 1.23.49 where users can supply a flow condition, which is evaluated as Groovy on the server. VulDB reports it is remotely exploitable with a public proof of concept; whether authentication is required is not stated (the CVSS vector indicates low privileges, PR:L). Teams not running FlowCI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["flowcorex"],"ptokens":["core","flow"],"labels":["flowci","flowcorex","groovy","high","java","package","selfhosted"],"campaign_type":null,"search_a":"'-124328':15A,18A '-2026':14A,17A 'argument':7A 'code':12A 'condit':6A 'core':4A,21A 'cve':13A,16A 'flow':3A,20A 'flow-core-x':2A,19A 'flowci':1A 'inject':11A 'let':8A 'remot':9A 'user':10A 'x':5A,22A","search_b":"'1.23.49':41B 'argument':45B 'attack':57B 'code':60B 'condit':44B 'conditionmanagerimpl.run':47B 'core':25B,37B 'evalu':51B 'exploit':68B 'flow':24B,36B 'flow-core-x':23B,35B 'flowci':27B,34B 'groovi':28B,49B 'host':33B 'inject':59B 'java':29B 'packag':30B 'pass':42B 'public':70B 'remot':56B 'run':62B 'sanit':53B 'script':50B 'self':32B 'self-host':31B 'server':65B 'without':52B 'x':26B,38B","search_c":"'1.23.49':84C 'affect':86C 'argument':106C 'attack':113C 'carri':118C 'code':110C 'compon':98C 'condit':107C 'conditionmanagerimpl.run':91C 'contact':136C 'core':80C 'core/src/main/java/com/flowci/core/common/manager/conditionmanagerimpl.java':95C 'disclos':125C 'disclosur':140C 'earli':137C 'element':87C 'evalu':101C 'exploit':122C 'file':94C 'flow':79C 'flow-core-x':78C 'flowci':77C 'found':75C 'function':90C 'groovi':99C 'inject':111C 'lead':108C 'manipul':103C 'may':130C 'possibl':115C 'public':128C 'remot':120C 'respond':144C 'script':100C 'use':132C 'vendor':134C 'vulner':72C 'way':147C 'x':81C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T11:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124328","severity":null,"published_at":"2026-11-08T11:16:34+00:00","modified_at":"2026-11-08T11:16:34+00:00","first_seen_at":"2026-11-08T11:47:27+00:00","fetched_at":"2026-11-08T11:47:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124328:2179","url":"https://vuldb.com/vuln/432648","severity":null,"published_at":"2026-11-08T11:50:08+00:00","modified_at":"2026-11-08T11:50:08+00:00","first_seen_at":"2026-11-08T11:50:08+00:00","fetched_at":"2026-11-08T11:50:08+00:00","note":"Only secondary source (VulDB, NVD empty); vendor silent, no fix on GitHub releases (latest v1.23.01). PoC is on a Notion page, not fetched. No exploitation in the wild known. Nothing marked verified as no vendor advisory exists.","cites":["https://vuldb.com/vuln/432648","https://github.com/FlowCI/flow-core-x/releases"]}],"documents":[{"id":101406,"url":"https://vuldb.com/vuln/432648","title":"VulDB VDB-432648: FlowCI flow-core-x ConditionManagerImpl.run code injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":101407,"url":"https://github.com/FlowCI/flow-core-x/releases","title":"FlowCI/flow-core-x releases","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}