CVE-2026-69263
Received Received - Intake

Command Injection in Flowise via npm_config_yes

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69263
EUVD
EUVD-2026-52795

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flowise flowise to 3.1.3 (inc)
flowiseai flowise 3.1.3
flowiseai flowise to 3.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Flowise versions before 3.1.3 allows bypassing a security mitigation for CVE-2025-8943. The original mitigation blocked certain command-line flags like -y and --yes on npx, but the code only explicitly denied specific environment variables (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS). Attackers could set npm_config_yes=true to achieve the same effect, causing npx to auto-install and execute packages when a Custom MCP server launched.

Detection Guidance

Check Flowise version with npm list -g flowise or flowise --version. If version is below 3.1.3, the system is vulnerable. Inspect environment variables for npm_config_yes=true or similar npm_config_* settings that could bypass mitigation.

Impact Analysis

This vulnerability could allow an attacker to automatically install and execute malicious packages on your system without explicit user consent. If you use Flowise with Custom MCP servers, an attacker might trick you into running harmful code by exploiting this bypass, potentially leading to system compromise or data theft.

Compliance Impact

This vulnerability allows unauthenticated remote code execution (RCE) due to incomplete environment variable restrictions in Flowise versions 3.1.1 and earlier. For GDPR, this could lead to unauthorized data access or processing, violating principles of lawfulness and security. Under HIPAA, it risks exposing protected health information (PHI) to unauthorized parties, potentially breaching confidentiality and integrity requirements.

Mitigation Strategies

Upgrade Flowise to version 3.1.3 or later. Remove or restrict npm_config_* environment variables that could enable auto-installation. Review MCP server configurations to ensure they do not rely on bypassed flags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart