Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
- Product
- flowise
- CVE
- CVE-2026-69263
- Affected
- flowise <= 3.1.2
- Fixed in
- 3.1.3
Last verified against sources: October 26, 2026
Am I affected?
flowise: affected flowise <= 3.1.2. Fixed in 3.1.3.
- Check your version: run
npm ls flowise. Versions <= 3.1.2 of flowise are affected. [1] - Check your version: run
npm ls flowise-components. Versions <= 3.1.2 of flowise-components are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install flowise@3.1.3(first patched version 3.1.3). [1] - Upgrade to the fixed version: run
npm install flowise-components@3.1.3(first patched version 3.1.3). [1] - Strip the
envobject before passing it to the child process, or replace the name blocklist with an allowlist of explicitly permitted variables. [1] - Adding the known dangerous variables to the blocklist (
npm_config_yes,npm_config_prefix,npm_config_userconfig,NODE_PATH,PYTHONPATH,PYTHONSTARTUP) narrows the immediate gap but is a stopgap. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The mitigation shipped for CVE-2025-8943 blocks the
-yand--yesflags onnpxto stop auto-installation of arbitrary packages. [1] - The environment-variable check in the same patch denies only four variable names by exact string match, and
npmreads its configuration directly fromnpm_config_*environment variables. [1] - Setting
npm_config_yes=truereproduces the--yesbehaviour the flag filter is meant to prevent, sonpxauto-installs and executes the named package. [1] - The mitigation is fully bypassed. [1]
Impact
What was done
- npm/flowise affected <= 3.1.2 patched 3.1.3. [1]
- The fix is to allowlist (or strip) the environment before it reaches the child process, not to extend the denylist. [1]
- Strip the
envobject before passing it to the child process, or replace the name blocklist with an allowlist of explicitly permitted variables. [1]
Sources
- GHSA-xc48-889x-5qmw — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-69263] Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
Product: flowise | Affected: flowise <= 3.1.2 | Fixed in: 3.1.3
Summary: The mitigation shipped for CVE-2025-8943 blocks the `-y` and `--yes` flags on `npx` to stop auto-installation of arbitrary packages.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/08/cve-2026-69263-flowiseCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-69263
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.