CVE-2026-59176 Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

What is CVE-2026-59176?

CVE-2026-59176 is a high-severity vulnerability in jordanburke functype, published on 28 Oct 2026.

Official description

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@<version>` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in `version` 1.4.4.

Weakness: CWE-829

Which versions are affected by CVE-2026-59176?

2 open source packages ship an affected version, including functype-mcp-server.

How do I fix CVE-2026-59176?

Upgrade functype-mcp-server to 1.4.4 or later.

Is CVE-2026-59176 being exploited?

There is no known exploitation of CVE-2026-59176 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wcjj-9m6g-2fr2.