GHSA-xc48-889x-5qmw: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Summary

The mitigation for CVE-2025-8943 in Flowise 3.1.1 blocks the `-y` and `--yes` flags on `npx`, but its environment-variable check denies only four names by exact match: PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH and NODE_OPTIONS. Because npm reads `npm_config_*` environment variables, setting `npm_config_yes=true` in an MCP server configuration makes `npx` auto-install and execute the named package, bypassing the patch. With `CUSTOM_MCP_SECURITY_CHECK=true`, the source says a default deployment without authentication allows unauthenticated remote code execution.

Mitigation

The source recommends allowlisting or stripping the environment before it reaches the child process rather than extending the denylist. No fixed version is stated.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• flowisenpmLLM dependency since 2024-03-12
• flowise-componentsnpmLLM dependency since 2023-04-10 · 1 tracked dependent

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online