CVE-2026-69263
Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
How to fix
- flowiseai flowise3.1.3 or later
- flowise3.1.3 or later
- flowise-components3.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flowiseai flowise | v < 3.1.3 | 3.1.3 |
| flowisenpm | v < 3.1.3 | 3.1.3 |
| flowise-componentsnpm | v < 3.1.3 | 3.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.