Description
The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable check in the same patch denies only four variable names by exact string match, and npm reads its configuration directly from npm_config_* environment variables.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: Authenticated RCE Via MCP Adapters - CVE-2026-40933
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
- Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE - CVE-2026-70470
- Flowise: Code Injection in CSVAgent leads to Authenticated RCE - CVE-2026-41137
You might also like:
See something that needs correcting? Let us knowUpdated August 04, 2026