AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable…? What should I do?

    The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages.

    Affected: flowise <= 3.1.2. Fixed in: 3.1.3. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/cve-2026-69263-flowise (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: flowise <= 3.1.2. Fixed in: 3.1.3.

      • Check your version: run npm ls flowise. Versions <= 3.1.2 of flowise are affected.
      • Check your version: run npm ls flowise-components. Versions <= 3.1.2 of flowise-components are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install flowise@3.1.3 (first patched version 3.1.3).
      2. Upgrade to the fixed version: run npm install flowise-components@3.1.3 (first patched version 3.1.3).
      3. Strip the env object before passing it to the child process, or replace the name blocklist with an allowlist of explicitly permitted variables.
      4. Adding the known dangerous variables to the blocklist (npm_config_yes, npm_config_prefix, npm_config_userconfig, NODE_PATH, PYTHONPATH, PYTHONSTARTUP) narrows the immediate gap but is a stopgap.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/08/cve-2026-69263-flowise (opens external site)

      Did this work for you?

    Add your answer or comment