Loading vulnerability…
Flowise Custom MCP npx Auto-Install Mitigation Bypass
CVE-2026-69263 is an incomplete denylist vulnerability in Flowise and flowise-components before version 3.1.3. The Custom MCP server launch logic attempted to mitigate CVE-2025-8943 by rejecting the npx -y and --yes command-line flags and filtering only a small set of environment variables by exact name. npm configuration variables using the npm_config_ prefix were not filtered. An attacker able to supply Custom MCP server environment settings could set npm_config_yes=true, which npm interprets equivalently to affirmative npx installation behavior. When the Custom MCP server starts, npx can consequently automatically retrieve and execute the specified package despite the prior flag-based restriction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits installation and execution of an attacker-selected npm package in the context of the Flowise process. This can result in arbitrary code execution with that process's privileges, including access to data, credentials, network resources, and application capabilities available to the Flowise deployment.
If you can’t patch tonight, do this now.
Until upgrade is complete, prevent untrusted users from creating or modifying Custom MCP server definitions and their environment settings. Restrict access to Flowise administration and MCP configuration, disable Custom MCP server execution where it is not required, and sanitize child-process environments using a minimal allowlist. Explicitly remove npm configuration variables and runtime search-path or startup variables from any environment passed to MCP child processes.
Patch, then assume compromise.
Upgrade Flowise and flowise-components to version 3.1.3 or later. The corrective approach is to avoid passing an inherited environment to MCP child processes, or to use an explicit allowlist of required environment variables rather than a denylist of selected dangerous names.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.