{"api_version":"1","generated_at":"2026-11-08T15:49:12+00:00","cve":"CVE-2026-124328","urls":{"html":"https://cve.report/CVE-2026-124328","api":"https://cve.report/api/cve/CVE-2026-124328.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124328","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124328"},"summary":{"title":"FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection","description":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-11-08 11:16:34","updated_at":"2026-11-08 11:16:34"},"problem_types":["CWE-74","CWE-94","CWE-94 Code Injection","CWE-74 Injection"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"2.1","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P","version":"4.0"}},{"version":"3.1","source":"cna@vuldb.com","type":"Primary","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","data":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"7.4","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","data":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C","data":{"baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C","version":"2.0"}}],"references":[{"url":"https://vuldb.com/vuln/432648/cti","name":"https://vuldb.com/vuln/432648/cti","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/cve/CVE-2026-124328","name":"https://vuldb.com/cve/CVE-2026-124328","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/432648","name":"https://vuldb.com/vuln/432648","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd","name":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/submit/1027401","name":"https://vuldb.com/submit/1027401","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124328","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124328","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.0","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.1","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.2","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.3","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.4","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.5","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.6","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.7","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.8","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.9","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.10","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.11","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.12","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.13","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.14","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.15","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.16","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.17","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.18","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.19","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.20","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.21","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.22","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.23","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.24","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.25","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.26","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.27","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.28","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.29","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.30","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.31","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.32","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.33","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.34","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.35","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.36","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.37","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.38","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.39","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.40","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.41","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.42","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.43","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.44","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.45","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.46","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.47","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.48","platforms":[]},{"source":"CNA","vendor":"FlowCI","product":"flow-core-x","version":"affected 1.23.49","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-11-07T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-11-07T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-11-07T20:40:34.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Zy0t1 (VulDB User)","lang":"en"},{"source":"CNA","value":"VulDB CNA Team","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*"],"modules":["Groovy Script Evaluation"],"product":"flow-core-x","vendor":"FlowCI","versions":[{"status":"affected","version":"1.23.0"},{"status":"affected","version":"1.23.1"},{"status":"affected","version":"1.23.2"},{"status":"affected","version":"1.23.3"},{"status":"affected","version":"1.23.4"},{"status":"affected","version":"1.23.5"},{"status":"affected","version":"1.23.6"},{"status":"affected","version":"1.23.7"},{"status":"affected","version":"1.23.8"},{"status":"affected","version":"1.23.9"},{"status":"affected","version":"1.23.10"},{"status":"affected","version":"1.23.11"},{"status":"affected","version":"1.23.12"},{"status":"affected","version":"1.23.13"},{"status":"affected","version":"1.23.14"},{"status":"affected","version":"1.23.15"},{"status":"affected","version":"1.23.16"},{"status":"affected","version":"1.23.17"},{"status":"affected","version":"1.23.18"},{"status":"affected","version":"1.23.19"},{"status":"affected","version":"1.23.20"},{"status":"affected","version":"1.23.21"},{"status":"affected","version":"1.23.22"},{"status":"affected","version":"1.23.23"},{"status":"affected","version":"1.23.24"},{"status":"affected","version":"1.23.25"},{"status":"affected","version":"1.23.26"},{"status":"affected","version":"1.23.27"},{"status":"affected","version":"1.23.28"},{"status":"affected","version":"1.23.29"},{"status":"affected","version":"1.23.30"},{"status":"affected","version":"1.23.31"},{"status":"affected","version":"1.23.32"},{"status":"affected","version":"1.23.33"},{"status":"affected","version":"1.23.34"},{"status":"affected","version":"1.23.35"},{"status":"affected","version":"1.23.36"},{"status":"affected","version":"1.23.37"},{"status":"affected","version":"1.23.38"},{"status":"affected","version":"1.23.39"},{"status":"affected","version":"1.23.40"},{"status":"affected","version":"1.23.41"},{"status":"affected","version":"1.23.42"},{"status":"affected","version":"1.23.43"},{"status":"affected","version":"1.23.44"},{"status":"affected","version":"1.23.45"},{"status":"affected","version":"1.23.46"},{"status":"affected","version":"1.23.47"},{"status":"affected","version":"1.23.48"},{"status":"affected","version":"1.23.49"}]}],"credits":[{"lang":"en","type":"reporter","value":"Zy0t1 (VulDB User)"},{"lang":"en","type":"coordinator","value":"VulDB CNA Team"}],"descriptions":[{"lang":"en","value":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"metrics":[{"cvssV4_0":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P","version":"4.0"}},{"cvssV3_1":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.1"}},{"cvssV3_0":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C","version":"3.0"}},{"cvssV2_0":{"baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"Code Injection","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-74","description":"Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-08T11:00:22.602Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-432648 | FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/432648"},{"name":"VDB-432648 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/432648/cti"},{"name":"CVE-2026-124328 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-124328"},{"name":"Submit #1027401 | FlowCI flow-core-x v1.23.01 remote code execution","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1027401"},{"tags":["exploit"],"url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"}],"timeline":[{"lang":"en","time":"2026-11-07T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-11-07T01:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-11-07T20:40:34.000Z","value":"VulDB entry last update"}],"title":"FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection","x_generator":["VulDB PVTS v202611"]}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-124328","datePublished":"2026-11-08T11:00:22.602Z","dateReserved":"2026-11-07T19:35:17.713Z","dateUpdated":"2026-11-08T11:00:22.602Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 11:16:34","lastModifiedDate":"2026-11-08 11:16:34","problem_types":["CWE-74","CWE-94","CWE-94 Code Injection","CWE-74 Injection"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":3.7}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124328","Ordinal":"1","Title":"FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl","CVE":"CVE-2026-124328","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124328","Ordinal":"1","NoteData":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","Type":"Description","Title":"FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl"}]}}}