---
id: "CVE-2026-124328"
page: "https://infrastack.ai/live/CVE-2026-124328"
kind: "vulnerability"
aliases: ["CVE-2026-124328"]
title: "FlowCI flow-core-x: condition argument lets remote users inject code"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "flow-core-x", "fixed": [], "affected": "<= 1.23.49", "ecosystem": "maven"}]
ecosystems: []
tags: ["flow-core-x", "flowci", "groovy", "java", "package", "self-hosted"]
not_affected_if: ["versions-above-1.23.49"]
published_at: "2026-11-08T11:16:34+00:00"
first_seen_at: "2026-11-08T11:47:27+00:00"
updated_at: "2026-11-08T11:50:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124328", "first_seen_at": "2026-11-08T11:47:27+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432648", "first_seen_at": "2026-11-08T11:50:08+00:00", "cites": ["https://vuldb.com/vuln/432648", "https://github.com/FlowCI/flow-core-x/releases"]}]
exploit_sources: []
---

# FlowCI flow-core-x: condition argument lets remote users inject code

Link for people: https://infrastack.ai/live/CVE-2026-124328 (this .md is for agents)

FlowCI flow-core-x up to 1.23.49 passes the condition argument of ConditionManagerImpl.run into Groovy script evaluation without sanitizing it. A remote attacker can inject code that runs on the server, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:flow-core-x affected <= 1.23.49 fixed no fixed version listed

## How to check

- Check your flow-core-x / flowci/core version; every release up to 1.23.49 is listed as affected by VulDB (the vendor has not published a fixed version).
- FlowCI evaluates the flow-level 'condition' (Groovy) in ConditionManagerImpl.run. Review which users can create or edit flows/YAML with a condition, and review existing flows for unexpected Groovy in condition fields.

## Fix

No fixed version known. The FlowCI releases page lists no release after v1.23.01 and VulDB says the vendor did not respond to disclosure.

## Timeline

- 2026-11-08T11:47:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124328
- 2026-11-08T11:50:08+00:00 analyst https://vuldb.com/vuln/432648 — Only secondary source (VulDB, NVD empty); vendor silent, no fix on GitHub releases (latest v1.23.01). PoC is on a Notion page, not fetched. No exploitation in the wild known. Nothing marked verified as no vendor advisory exists.

## Documents

- [advisory] VulDB VDB-432648: FlowCI flow-core-x ConditionManagerImpl.run code injection https://vuldb.com/vuln/432648
- [describes] FlowCI/flow-core-x releases https://github.com/FlowCI/flow-core-x/releases

## From the sources

A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_