{"affected":[{"product":"flow-core-x","source":"CNA: VulDB","vendor":"FlowCI","versions":[{"status":"affected","version":"1.23.0"},{"status":"affected","version":"1.23.1"},{"status":"affected","version":"1.23.2"},{"status":"affected","version":"1.23.3"},{"status":"affected","version":"1.23.4"},{"status":"affected","version":"1.23.5"},{"status":"affected","version":"1.23.6"},{"status":"affected","version":"1.23.7"},{"status":"affected","version":"1.23.8"},{"status":"affected","version":"1.23.9"},{"status":"affected","version":"1.23.10"},{"status":"affected","version":"1.23.11"},{"status":"affected","version":"1.23.12"},{"status":"affected","version":"1.23.13"},{"status":"affected","version":"1.23.14"},{"status":"affected","version":"1.23.15"},{"status":"affected","version":"1.23.16"},{"status":"affected","version":"1.23.17"},{"status":"affected","version":"1.23.18"},{"status":"affected","version":"1.23.19"},{"status":"affected","version":"1.23.20"},{"status":"affected","version":"1.23.21"},{"status":"affected","version":"1.23.22"},{"status":"affected","version":"1.23.23"},{"status":"affected","version":"1.23.24"},{"status":"affected","version":"1.23.25"},{"status":"affected","version":"1.23.26"},{"status":"affected","version":"1.23.27"},{"status":"affected","version":"1.23.28"},{"status":"affected","version":"1.23.29"},{"status":"affected","version":"1.23.30"},{"status":"affected","version":"1.23.31"},{"status":"affected","version":"1.23.32"},{"status":"affected","version":"1.23.33"},{"status":"affected","version":"1.23.34"},{"status":"affected","version":"1.23.35"},{"status":"affected","version":"1.23.36"},{"status":"affected","version":"1.23.37"},{"status":"affected","version":"1.23.38"},{"status":"affected","version":"1.23.39"},{"status":"affected","version":"1.23.40"},{"status":"affected","version":"1.23.41"},{"status":"affected","version":"1.23.42"},{"status":"affected","version":"1.23.43"},{"status":"affected","version":"1.23.44"},{"status":"affected","version":"1.23.45"},{"status":"affected","version":"1.23.46"},{"status":"affected","version":"1.23.47"},{"status":"affected","version":"1.23.48"},{"status":"affected","version":"1.23.49"}]}],"cveId":"CVE-2026-124328","cwes":["CWE-94","CWE-74"],"description":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulDB","url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P","version":"4.0"},{"score":7.4,"severity":"high","source":"CNA: VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.1"},{"score":7.4,"severity":"high","source":"CNA: VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.0"},{"score":6.5,"severity":"medium","source":"CNA: VulDB","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C","version":"2.0"},{"score":2.1,"severity":"low","source":"NVD: cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":7.4,"severity":"high","source":"NVD: cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: cna@vuldb.com","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"}],"modifiedAt":1794136594733,"publishedAt":1794135622602,"references":[{"source":"CNA: VulDB","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/432648"},{"source":"CNA: VulDB","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/432648/cti"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-124328"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1027401"},{"source":"CNA: VulDB","tags":["exploit"],"url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"},{"source":"cna@vuldb.com","tags":[],"url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/cve/CVE-2026-124328"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/submit/1027401"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/432648"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/432648/cti"}],"remediation":[],"revision":"6ed7bc69b28eae5dd691b044cc9ad77365f7f4b0dcb1dfce94b1414848d3f279","sources":[{"modifiedAt":1794135622602,"name":"CNA: VulDB","retrievedAt":1794139699407,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124328"},{"modifiedAt":1794136594733,"name":"NVD","retrievedAt":1794140146948,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124328"}],"ssvc":null,"status":"published","title":"FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection","updatedAt":1794140146948}