CVE-2026-59176

Description

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the set_functype_version MCP tool in functype-mcp-server accepts an unconstrained version string using only z.string() validation in packages/mcp-server/src/index.ts and interpolates it into functype@<version> for pnpm add. Package-alias syntaxes such as file:, npm:, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, initDocsData(true) in packages/mcp-server/src/lib/docs/data.ts resolves functype/cli and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process’s privileges. Any MCP client able to send a tools/call request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in stdio mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default TRANSPORT_TYPE=httpStream deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in version 1.4.4.