Functype MCP server flaw let tool calls run arbitrary code

A vulnerability in Functype's functype-mcp-server allowed anyone able to call one of its tools to run arbitrary code on the machine hosting the server, according to a National Vulnerability Database entry published on 28 October 2026. The flaw, tracked as CVE-2026-59176, affects all versions before 1.4.4 and is fixed in that release.

Functype is a family of TypeScript functional programming libraries. Its MCP server exposes tools to AI assistants over the Model Context Protocol, the standard that lets assistants call external software. According to the NVD record, the set_functype_version tool accepted a version string validated only as a generic string, then interpolated it into a functype@<version> argument passed to the pnpm add package installer.

That is enough to break out. The advisory says package-alias syntaxes such as file:, npm:, URLs or filesystem paths can cause an arbitrary local or remote package to be installed under the name functype. The server then calls a documentation initialisation routine that resolves functype/cli and dynamically imports the freshly installed module. At that point the attacker's JavaScript runs inside the MCP server process, with whatever privileges that process holds.

The consequences listed in the advisory are the usual ones for code execution: an attacker can read secrets held in the process environment, modify files, or kill the server.

Two things make the issue worse than a typical install-command bug. First, according to the NVD entry the tool is enabled by default and requires no authentication when the server runs in stdio mode, the local transport most desktop AI clients use. Any MCP client that can send a tools/call request invoking the tool can trigger the flaw.

Second, the attacker does not have to be the one holding the client. The advisory states that a connected AI assistant vulnerable to indirect prompt injection — where hidden instructions in content the model reads are treated as commands — can be induced to invoke the tool from a malicious document or web page. In that scenario the assistant becomes the delivery mechanism, calling a legitimate, enabled tool with a hostile argument.

Deployments that set TRANSPORT_TYPE=httpStream, which is not the default, widen the exposure further. The advisory says a network-accessible attacker in that configuration does not need local access at all.

The root cause is narrow and familiar. Input that is destined for a shell-like command was validated for type but not for shape. A version string looks harmless until a package manager interprets it as an instruction about where to fetch code from. The MCP layer adds the twist: the untrusted input arrives through an automated agent rather than a human, and the agent may have been talked into sending it.

Functype has published a fix in version 1.4.4, released alongside a commit and a GitHub security advisory, GHSA-wcjj-9m6g-2fr2. Operators running the MCP server should upgrade. The NVD record does not say whether the flaw was exploited in the wild, and no exploitation has been reported in the sources available.