Flowise MCP Environment-Variable Security Check Bypass (Unauthenticated RCE)

Technical Analysis

The mitigation for CVE-2025-8943 added validateCommandFlags (blocks -y/--yes and other dangerous CLI flags) and validateEnvironmentVariables (blocks PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS by exact string match) before launching MCP server subprocesses via npx, node, or python3. The flaw is that npm, node, and python3 all support equivalent behavior-altering configuration through environment variables outside this four-item list, most notably npm_config_yes, which duplicates the effect of the blocked --yes flag and causes npx to silently auto-install and execute an attacker-named package. Because the check is a hardcoded denylist rather than an allowlist/strip-and-sanitize of the child process environment, it is incomplete by construction and additional vectors (npm_config_prefix, npm_config_userconfig, NODE_PATH, PYTHONPATH, PYTHONSTARTUP) remain exploitable via the same root cause. The entry point is the MCP server configuration object (command/args/env) accepted by the Flowise API; since default deployments ship without authentication, this crosses from a configuration-input trust boundary directly into unauthenticated code execution on the host running Flowise.

Affected Systems

Flowise, flowise-components; protocols: MCP

Detection Signatures

• MCP server config env block containing npm_config_yes, npm_config_prefix, npm_config_userconfig, NODE_PATH, or PYTHONSTARTUP
• npx invocation followed by unexpected package installation logs when CUSTOM_MCP_SECURITY_CHECK=true is set
• Child process spawn of npx/node/python3 with env vars not matching the documented four-item Flowise blocklist (PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, NODE_OPTIONS)
• Unauthenticated requests to Flowise API endpoints that create/update MCP tool nodes
• Process execution originating from Flowise with no corresponding authenticated user session

Remediation Steps

1. 1

   Upgrade Flowise

   Update to a patched Flowise/flowise-components release that addresses this GHSA/CVE once available; track GHSA-xc48-889x-5qmw for the fix.

2. 2

   Replace denylist with allowlist for child process environment

   Redesign validateEnvironmentVariables to construct a minimal allowlisted environment for spawned MCP interpreters (npx, node, python3, docker) rather than blocking specific known-dangerous variable names.

3. 3

   Enforce authentication on Flowise deployments

   Never run Flowise exposed to untrusted networks without authentication; require auth on all API endpoints, especially those that create or modify MCP server configurations.

4. 4

   Restrict interpreter execution privileges

   Run MCP server subprocesses in a sandboxed, least-privilege environment (containers, restricted users, no outbound network to arbitrary npm registries) to limit blast radius of any bypass.

5. 5

   Monitor and alert on MCP config changes

   Log and alert on creation/modification of MCP server tool definitions, especially those containing env blocks with non-standard npm_config_* or *PATH variables.

6. 6

   Disable auto-install behavior at the system level

   Set npm/npx to require explicit confirmation globally (e.g., via .npmrc yes=false enforced at the OS/container level) so environment variables cannot override it from within the Flowise process.