CVE-2026-69263

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.

• CWE-184

• https://github.com/FlowiseAI/Flowise/commit/a4c4e4988cded15edf725e762560575b889ae351Patch
• https://github.com/FlowiseAI/Flowise/pull/6471Issue Tracking, Patch
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3Patch, Release Notes
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xc48-889x-5qmwExploit, Vendor Advisory
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-xc48-889x-5qmwExploit, Vendor Advisory

Published

Aug 4, 2026

Last Modified

Sep 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69255Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-69256Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-69257Flowise is a drag & drop user interface to build a customize…8.6
• CVE-2026-69258Flowise is a drag & drop user interface to build a customize…9.1
• CVE-2026-69259Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-69262Flowise is a drag & drop user interface to build a customize…8.1
• CVE-2026-69264Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-co…9.8
• CVE-2026-69265Out-of-bounds read in Windows NTFS allows an authorized atta…7.8
• CVE-2026-69266Integer overflow or wraparound in Windows DHCP Server allows…8.8
• CVE-2026-69267Insufficient granularity of access control in Windows Connec…6.5
• CVE-2026-69268Improper access control in Microsoft Office SharePoint allow…8.8
• CVE-2026-69269Integer underflow (wrap or wraparound) in Microsoft Standard…7.8