CVE-2026-69263

CVE 2026-69263 What CVE 2026-69263 is a patch bypass of the old RCE vulnerability patched back in August of 2025. The patch introduced a Denylist that blocked installation of arbitrary packages. How Since npm reads config from environment variables, setting the npmconfigyes=true environment...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-69263

Flowise (a drag-and-drop UI for building LLM workflows) prior to 3.1.3 has a patch bypass of CVE-2025-8943 in packages/components/nodes/tools/MCP/core.ts. The original fix blocked -y/--yes flags on npx, but the environment-variable denylist only rejected PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, ...