CVE-2026-69263 is a critical (CVSS 9.8) flaw in Flowise before 3.1.3. An earlier fix blocked the npx yes flags, but npm also reads the same setting from an environment variable, so a Custom MCP server could still make npx install and run a named package. Upgrade to Flowise 3.1.3.
What's affected
- Product: Flowise, the drag and drop builder for large language model flows (FlowiseAI).
- Affected versions: before 3.1.3.
- Fixed version: 3.1.3. The Flowise GitHub repository page shows that it was archived on 13 August 2026, so check where maintained releases come from before you plan the upgrade.
- What the advisory says: the mitigation for CVE-2025-8943 blocked the yes flags on npx, but the environment variable deny list covered only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH and NODE_OPTIONS by exact name. Because npm reads configuration from npm_config_* variables, npm_config_yes=true reproduced the yes behavior, so npx auto installed and ran the named package when a Custom MCP server launched.
- Weaknesses: CWE-184 incomplete list of disallowed inputs.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Check the installed Flowise version:
npm ls -g flowise
docker image ls | grep -i flowise
For a running instance, the version is shown in the application's settings or about page. Anything below 3.1.3 is in range. Then check which chatflows are reachable without authentication through the prediction endpoint, because that endpoint is the entry point for this CVE.
What to do now
- Find every Flowise instance, including test and demo servers.
- Upgrade to Flowise 3.1.3 or later.
- Check that Flowise is not reachable from the internet without authentication in front of it.
- Check Custom MCP server settings and the CUSTOM_MCP_ALLOWED_ENV_VARS setting, and allow only the variables you need.
- Review chatflows and agent flows for nodes or settings you did not create.
- Rotate API keys and credentials stored in Flowise if the instance was exposed.
Why it matters
This is a lesson about deny lists. The first fix blocked one spelling of a dangerous option. The same behavior was reachable through another spelling, an environment variable that npm treats as configuration. A list of known bad inputs fails whenever the tool being protected has more than one way to say the same thing.
The fix described in the pull request moves the other way. It replaces the deny list with an operator controlled allow list of environment variables, named CUSTOM_MCP_ALLOWED_ENV_VARS, and defaults Custom MCP to SSE. Allow lists are harder to bypass because anything not named is refused. The CISA KEV flag is false and no exploitation is reported. Because Custom MCP launches processes on the Flowise host, treat the ability to add such servers as a high privilege.
Try it yourself
This walkthrough shows how a scan turns a vulnerability record into a prioritized, fixable finding.
Click through it at your own pace, or open it full screen.
Quick check
Why did the earlier fix fail?
It blocked specific flags and variable names. npm accepts the same setting under another name, so the block was incomplete.
What changed in the fix?
Per the pull request, an allow list of permitted environment variables replaced the deny list, and Custom MCP defaults to SSE.
Sources
- GitHub security advisory GHSA-xc48-889x-5qmw
- Fix pull request 6471
- Flowise release 3.1.3
- Gold record for CVE-2026-69263
Last reviewed: 19 October 2026.
