EXPOSURES › CVE-2026-69263
CVE-2026-69263
CRITICALCVE-2026-69263 in Flowise allowed auto-installation and execution of arbitrary packages via npm_config_yes=true, bypassing a prior mitigation.
The vulnerability stemmed from an incomplete environment-variable whitelist that allowed npm_config_yes to replicate the --yes flag, enabling npx to auto-install and execute arbitrary packages when a Custom MCP server launched. A DIB org should care because this bypasses intended security controls, allowing remote code execution without user interaction, which could lead to data exfiltration or system compromise. Organizations must ensure their software supply chain is rigorously vetted and that environment-variable handling is strictly enforced to prevent similar bypasses.
Shame score — The failure represents a negligent bypass of a previously implemented mitigation, allowing an attacker to execute arbitrary code without user interaction, which is a severe and avoidable security flaw.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.