CVE 2026-69263

[ What ]

CVE 2026-69263 is a patch bypass of the old RCE vulnerability patched back in August of 2025. The patch introduced a Denylist that blocked installation of arbitrary packages.

[ How ]

Since npm reads config from environment variables, setting the npm_config_yes=true environment variable flips the blocked behaviour back on.

[ Affected ]

Flowise 3.1.1, current as of when reported. Fixed in 3.1.3

[ PoC ]

The following MCP server configuration bypasses the patch with CUSTOM_MCP_SECURITY_CHECK=true:

{
  "mcpServers": {
    "bypass": {
      "command": "npx",
      "args": ["cowsay"],
      "env": {
        "npm_config_yes": "true"
      }
    }
  }
}

cowsay is a benign package used here only to prove execution. A real attacker would substitute their own payload.

Execution path:

1. validateCommandFlags passes, because args contains no blocked flags.
2. validateEnvironmentVariables passes, because npm_config_yes is not in the four-item blocklist.
3. npx auto-installs and executes the specified package, proving arbitrary execution is possible with the privileges of the Flowise process.

On a default deployment with no authentication, any unauthenticated user who can reach the Flowise API can trigger this.

Additional bypass vectors (same root cause)

The following variables are also absent from the blocklist and influence execution through the other permitted interpreters:

[ Disclosure ]

This RCE vulnerability was responsibly disclosed to the maintainers at Flowise through their github repo. You can find the report here

[ References ]

• CVE-2026-69263
• Flowise Security Advisory Report
• leoelsolh - CVE-2026-69263
• Fix (PR #6471)
• CVE-2025-8943
• CWE-184: Incomplete List of Disallowed Inputs