The flaw allows an attacker to inject the environment variable npm_config_yes=true, which bypasses the mitigation that blocked the -y and --yes flags on npx. This causes npx to auto‑install and execute any named package when a Custom MCP server starts, enabling arbitrary code execution without authentication. The weakness arises from improper validation of environment‑variable names (CWE‑184).

The vulnerability is present in Flowise AI’s Flowise platform prior to version 3.1.3. All installations running earlier releases of the drag‑and‑drop UI that build LLM flows are affected. The issue was addressed in the 3.1.3 release and in subsequent versions.

With a CVSS score of 8.7 the vulnerability is high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires injecting npm_config_yes into the environment used by a Custom MCP server, with no additional privileges needed. Because the bypass operates without authentication, any system exposing a Custom MCP endpoint is at significant risk of remote code execution.