CVE-2026-69263

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Published Aug 4, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

Analysis

Technical impact

The flaw allows an attacker to inject the environment variable npm_config_yes=true, which bypasses the mitigation that blocked the -y and --yes flags on npx. This causes npx to auto‑install and execute any named package when a Custom MCP server starts, enabling arbitrary code execution without authentication. The weakness arises from improper validation of environment‑variable names (CWE‑184).

Affected Systems

The vulnerability is present in Flowise AI’s Flowise platform prior to version 3.1.3. All installations running earlier releases of the drag‑and‑drop UI that build LLM flows are affected. The issue was addressed in the 3.1.3 release and in subsequent versions.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires injecting npm_config_yes into the environment used by a Custom MCP server, with no additional privileges needed. Because the bypass operates without authentication, any system exposing a Custom MCP endpoint is at significant risk of remote code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FlowiseAI

Flowise

affected

Version	Status	Constraints
`< 3.1.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Flowiseai

Flowise

Version	Status	Scheme	Platform
`[0,3.1.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Flowise to version 3.1.3 or later to apply the fix for CVE-2025-8943.
Ensure that untrusted users cannot set npm_config_* environment variables when invoking npx; sanitize or restrict environment settings in the execution context.
Review and harden Custom MCP server configurations to allow only trusted sources and disable automatic npm package installation in production environments.

Generated by OpenCVE AI on August 4, 2026 at 19:25 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-xc48-889x-5qmw	Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.662% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FlowiseAI/Flowise/commit/a4c4e4988cded15edf725e762560575b889ae351
https://github.com/FlowiseAI/Flowise/pull/6471
https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xc48-889x-5qmw

History

Sep 14, 2026 9:00 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:flowiseai:flowise::::::::
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 4, 2026 7:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Flowiseai Flowiseai flowise
Vendors & Products		Flowiseai Flowiseai flowise

Aug 4, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 4, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
Title		Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
Weaknesses		CWE-184
References		https://github.com/FlowiseAI/Flowise/commit/a4c4e4988cded15edf725e762560575b889ae351 https://github.com/FlowiseAI/Flowise/pull/6471 https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xc48-889x-5qmw
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`