GHSA-xc48-889x-5qmw: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise 3.1.1 has a security bypass in its patch for CVE-2025-8943. The patch blocks dangerous command-line flags (like `-y` and `--yes`) to prevent automatic package installation, but attackers can bypass this by setting the `npm_config_yes` environment variable (a way to pass configuration to npm through the environment rather than command-line flags), which achieves the same effect. On unprotected Flowise deployments without authentication, this allows unauthenticated remote code execution (running arbitrary commands on the server).