CVE-2026-69263 in Flowise
Summary
by MITRE • 08/04/2026
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability CVE-2025-8943 represents a critical security flaw in Flowise versions prior to 3.1.3 that demonstrates a classic case of incomplete input validation and privilege escalation through environment variable manipulation. This issue specifically affects the Custom MCP server functionality within Flowise, where the application fails to properly sanitize environment variables that could be leveraged by malicious actors to bypass intended security measures. The vulnerability stems from an overly restrictive mitigation approach that blocks specific command-line flags while failing to account for alternative methods of achieving the same outcome through environment variable configuration.
The technical implementation of this flaw occurs in the packages/components/nodes/tools/MCP/core.ts file where the system attempts to prevent automatic execution by blocking specific environment variables including PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS. However, this approach is fundamentally flawed because it does not account for npm's configuration mechanism that reads settings from npm_config_* prefixed environment variables. When an attacker sets npm_config_yes=true in the environment, they effectively reproduce the behavior of the --yes flag without triggering the detection system, as the system only monitors exact matches of the blocked variable names rather than recognizing the equivalent configuration through npm's standardized environment variable naming convention.
This vulnerability creates a significant operational impact by allowing unauthorized code execution within the context of the Flowise application. The attack vector specifically targets the Custom MCP server launch process where npx commands are executed without proper user confirmation, potentially enabling malicious actors to install and execute arbitrary packages from the npm registry. The flaw essentially undermines the intended security boundaries that should prevent automatic package installation and execution, creating a pathway for code injection attacks that could lead to complete system compromise.
The mitigation implemented in Flowise version 3.1.3 addresses this issue by providing comprehensive environment variable filtering that accounts for npm's configuration mechanism and prevents the exploitation of equivalent functionality through different variable naming conventions. This fix aligns with industry best practices for secure coding and demonstrates proper defense-in-depth principles by not relying on a single layer of protection. The solution should be evaluated against CWE-78 and CWE-88 categories which specifically address command injection vulnerabilities and improper neutralization of special elements used in argument lists, respectively, while also considering ATT&CK techniques related to privilege escalation through environment variable manipulation.
Organizations using Flowise should immediately upgrade to version 3.1.3 or later to remediate this vulnerability, as the attack surface remains significant for any environment where Flowise is used with untrusted inputs or where users may have the ability to configure MCP servers. The vulnerability highlights the importance of comprehensive input validation and the need to understand how different configuration mechanisms interact with security controls, particularly in applications that rely heavily on npm package management and dynamic code execution environments.