CVE-2026-59176

Name of the Vulnerable Software and Affected Versions functype-mcp-server versions prior to 1.4.4

Description The set functype version MCP tool in functype-mcp-server allows for Remote Code Execution (RCE) because it accepts an unconstrained version string and interpolates it into a pnpm add command. An attacker can use package-alias syntaxes such as file:, npm:, URLs, or paths to force the installation of an arbitrary local or remote package. Following installation, the initDocsData() function resolves and dynamically imports the functype/cli module, executing attacker-controlled JavaScript with the privileges of the MCP server process. This can be exploited by any MCP client capable of sending a tools/call request, or via indirect prompt injection where an AI assistant is induced to invoke the tool from a malicious document or web page. In deployments using TRANSPORT TYPE=httpStream, the issue is accessible to network-based attackers. Successful exploitation allows the attacker to read process secrets, modify files, or terminate the server.

Recommendations Update to version 1.4.4. As a temporary mitigation, restrict access to the set functype version tool to prevent unauthorized users or AI assistants from invoking it.