functype-mcp-server: Code execution via unvalidated version in set_functype_version
Summary
The set_functype_version tool of the functype-mcp-server package accepts an unvalidated version string and passes it to pnpm add. Package alias syntaxes such as file:, npm: or URLs can install an arbitrary package, whose code the server then imports and runs with its own privileges. In the default stdio mode, any MCP client able to call the tool can exploit this without authentication, and an AI assistant can be tricked into calling it via prompt injection. In the non-default httpStream mode, network attackers can exploit it too; successful exploitation can expose process secrets, modify files or stop the server.
Affected
- functype-mcp-server before 1.4.4 (npm)
- The advisory references the jordanburke/functype repository; the affected range is stated as below 1.4.4.
Fixed in
- Upgrade functype-mcp-server to 1.4.4 or later.
Workaround
Unknown. The vendor documents no workaround. In affected versions, the httpStream transport exposes the tool to network callers, so do not use it on a network interface until patched.
Exploitation
- Public reproduction details are referenced in the advisory; the sources reviewed did not confirm this.
- No evidence of exploitation in the wild was found in the sources reviewed.
- EPSS score: 0.21 % (percentile 11).
Our recommendation
- Identify all hosts, developer workstations and CI runners where functype-mcp-server is installed, including its version.
- Upgrade functype-mcp-server to 1.4.4 or later.
- Check whether the httpStream transport is in use and restrict it to loopback or disable it.
- Review node_modules and logs for unexpected functype package sources, such as local paths or URLs.
- Restrict MCP clients to trusted tools and monitor for unexpected package installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wcjj-9m6g-2fr2 github.com
- Fix commit c0d58ad github.com
- Release v1.4.4 github.com
- OSV entry GHSA-wcjj-9m6g-2fr2 osv.dev
- GitHub Advisory Database entry github.com
- Vulners CVE-2026-59176 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:55.
Original description (NVD)
Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@<version>` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in `version` 1.4.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.