CVE-2026-59176: Functype MCP Server Arbitrary Code Execution

The functype-mcp-server prior to version 1.4.4 contains an arbitrary code execution vulnerability in the `set_functype_version` MCP tool that accepts unconstrained version strings and interpolates them into package installation commands. An attacker or AI assistant can exploit this to install malicious packages and execute arbitrary code with the server's privileges.

Disclosed 28 October 2026 · Record updated 28 October 2026

Impact

Arbitrary code execution with MCP server process privileges, allowing attackers to read process secrets, modify files, or terminate the server. Exploitable by MCP clients, connected AI assistants via prompt injection, or network attackers in non-default deployments.

Our coverage

A factory worker feeds an unmarked box directly into a machine without inspection, causing it to malfunction and scatter parts across the floor.

Vulnerabilities

Functype MCP server flaw let tool calls run arbitrary code

A version string passed to an MCP tool was fed straight into a package install command, according to an advisory published on 28 October 2026.

28 Oct 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-59176