CVE-2026-69263Critical· 9.8▾ AbyssalPoC availableFlowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
1 GitHub repo
Last analysed / modified upstream
— → 9.8
high → critical
0.3% → 0.5%
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS by exact environment-variable name. Because npm reads configuration from npm_config_* variables, setting npm_config_yes=true reproduced --yes behavior without using a blocked flag, causing npx to auto-install and execute the named package when a Custom MCP server launched. This issue is fixed in version 3.1.3.
flowise < 3.1.3Upgrade past the affected range:
flowise 3.1.3Affected packages:
flowise <= 3.1.2flowise-components <= 3.1.2Patched in:
flowise 3.1.3flowise-components 3.1.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70470Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70475Medium· 6.5Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70476High· 8.2Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70477Critical· 9.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-70471Medium· 6.5Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
CVE-2026-69264Critical· 9.8Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide