CVE-2026-69263

Flowise, an open-source drag-and-drop UI for building LLM flows, contains an incomplete-blocklist flaw (CWE-184) in the environment-variable sanitizer for Custom MCP servers in packages/components/nodes/tools/MCP/core.ts. The fix for CVE-2025-8943 blocked npx's -y/--yes flags and denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact variable name, but a low-privileged user who can configure a Custom MCP server can instead set npm_config_yes=true, which npm interprets as the --yes option. This causes npx to silently auto-install and execute an attacker-specified npm package when the MCP server launches, resulting in remote code execution on the Flowise host with high confidentiality, integrity, and availability impact (CVSS 4.0: 8.7). All Flowise versions prior to 3.1.3 are affected, and the flaw is fixed in 3.1.3. A public advisory with reproduction details exists, but exploitation likelihood is currently low (EPSS 0.3%, 27th percentile) and the CVE is not in the CISA KEV catalog.

What to do: Upgrade Flowise to version 3.1.3 or later, where the sanitizer blocks npm_config_* environment variables. Until patched, restrict who can create or edit Custom MCP server configurations and audit existing MCP tool configs for npm_config_* entries or unexpected npm package names. Also review host logs for npx/npm auto-install activity originating from the Flowise process to rule out prior abuse.