functype-mcp-server RCE via unsanitized pnpm install

The set_functype_version MCP tool in functype-mcp-server accepts an unconstrained version string, allowing attackers to inject arbitrary package aliases and execute remote code through dynamic import of attacker-controlled packages.

Disclosed 9 September 2026 · Record updated 1 October 2026

Impact

Remote code execution with full server process privileges (confidentiality, integrity, and availability impact), CVSS 7.8 High

Our coverage

A factory worker hands an unmarked package directly to a machine without inspection, and it automatically unpacks and executes whatever's inside the sealed box.

Vulnerabilities

MCP tool in functype-mcp-server allows remote code execution

A version string passed straight to pnpm lets anyone who can call the tool install and run arbitrary code inside the MCP server process.

14 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-wcjj-9m6g-2fr2