CyberRota Analysis
AI-GeneratedFlowise versions prior to 3.1.3 are vulnerable to a bypass that allows the execution of arbitrary packages via npx by exploiting npm configuration variables, despite restrictions on certain command-line flags. This could lead to unauthorized code execution when a Custom MCP server is launched, posing a significant risk to environments using Flowise for building large language model flows. Organizations utilizing Flowise should prioritize upgrading to version 3.1.3 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.