high · CVSS v3 7.4

CVE-2026-124328

FlowCI flow-core-x versions up to 1.23.49 contain a remote code execution vulnerability in the ConditionManagerImpl.run method. An attacker

Overview

FlowCI flow-core-x versions up to 1.23.49 contain a remote code execution vulnerability in the ConditionManagerImpl.run method. An attacker can inject arbitrary Groovy code via the condition argument, enabling full system compromise. The flaw is publicly disclosed and unpatched.

Description

A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality, Integrity, and Availability are all at risk. Unauthorized code execution can allow attackers to read, modify, or delete data, disrupt services, and gain a persistent foothold. Defenders should treat affected instances as compromised until patched.

Remediation

Upgrade FlowCI flow-core-x to version 1.23.50 or later. If upgrade is not possible, restrict network access to the ConditionManagerImpl endpoint, disable Groovy script evaluation, or apply firewall rules blocking external requests to the condition parameter. Monitor logs for suspicious Groovy code execution.

Risk context

High severity (CVSS 7.4) and public disclosure make this a time‑critical issue. Immediate action is recommended to prevent exploitation.

Affected products

  • FlowCI flow-core-x
  • FlowCI flow-core
  • FlowCI flow-core-x 1.23.49

Scores

Severity
high
CVSS v2
6.5
CVSS v3
7.4
CVSS v4
—
EPSS
—

remote code execution Groovy code injection FlowCI high severity public disclosure

← All CVEs

Related CVEs

high

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

View analysis

high

CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

View analysis

high

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

View analysis

high

CVE-2026-123562

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

View analysis