Loading vulnerability…
CVE-2026-69263 is an incomplete denylist vulnerability in Flowise and flowise-components before version 3.1.3. The Custom MCP server launch logic attempted to mitigate CVE-2025-8943 by rejecting the npx -y and --yes command-line flags and filtering only a small set of environment variables by exact name. npm configuration variables using the npm_config_ prefix were not filtered. An attacker able to supply Custom MCP server environment settings could set npm_config_yes=true, which npm interprets equivalently to affirmative npx installation behavior. When the Custom MCP server starts, npx can consequently automatically retrieve and execute the specified package despite the prior flag-based restriction.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Small repository containing a documentation-heavy proof of concept for CVE-2026-69263, a Flowise patch-bypass leading to RCE. Structure is minimal: LICENSE, README.md, and poc.json. There is no executable exploit script; the core artifact is poc.json, an MCP server configuration that sets command=npx, args=["cowsay"], and env.npm_config_yes=true. According to the README, this bypasses Flowise's denylist-based MCP security checks when CUSTOM_MCP_SECURITY_CHECK=true, because the blocked flags are not present and the environment variable is not denylisted. As a result, npx auto-installs and executes the specified package, demonstrating arbitrary execution with the privileges of the Flowise process. The README further explains likely exploitation conditions: vulnerable Flowise 3.1.1, fixed in 3.1.3, and reachable Flowise API access, potentially unauthenticated on default deployments. It also documents related environment-variable bypass avenues (npm_config_prefix, npm_config_userconfig, NODE_PATH, PYTHONPATH, PYTHONSTARTUP), indicating the broader root cause is incomplete filtering of dangerous interpreter/package-manager environment variables rather than a single hardcoded bypass.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Flowise vulnerability that could bypass a prior mitigation related to package execution via npx, enabling unauthorized code installation and execution with Flowise process privileges.
A Flowise vulnerability in versions prior to 3.1.3 that bypasses an earlier mitigation by using npm_config_* environment variables, allowing npx to auto-install and execute a named package when a Custom MCP server is launched.
A high-severity Flowise vulnerability caused by incomplete environment-variable filtering in Custom MCP server execution. The filter blocked the npx -y/--yes flags but failed to block npm_config_yes, enabling automatic npx package installation and execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.