Threats affecting pkg:github/dromara/warm-flow

CVE-2026-6125 is a medium severity code injection vulnerability in Dromara warm-flow versions up to 1.8.4. It affects the SpelHelper.parseExpression function within the Workflow Definition Handler component, specifically in the /warm-flow/save-json file. The vulnerability arises from manipulation of the listenerPath, skipCondition, or permissionFlag arguments, allowing remote attackers to inject code. Although an exploit has been publicly released, there is no confirmed patch or official remediation available at this time.