MCP tool in functype-mcp-server allows remote code execution

A GitHub security advisory published on 9 September 2026 describes a remote code execution flaw in functype-mcp-server, an npm package that exposes the functype library's documentation to AI agents over the Model Context Protocol (MCP), the standard that lets assistants call external tools. The advisory, tracked as CVE-2026-59176 and GHSA-wcjj-9m6g-2fr2, rates the issue 7.8 (High) on the CVSS scale and says the impact is full loss of confidentiality, integrity and availability for the account running the server.

The problem sits in a single tool called set_functype_version. According to the advisory, the tool takes a version parameter validated only as a generic string, with no semver format check, no allowlist of release tags, and no rejection of alias syntaxes such as file: or npm:. The server then builds the package specifier functype@<version> and hands it to pnpm add without sanitisation. Because npm and pnpm specifiers accept local paths and package aliases, an attacker who can send a tools/call request can make the server install any local or remote package under the name functype.

Installation alone would be bad enough, but the advisory describes a second step that turns it into code execution. Immediately after the install, the server calls an internal function that resolves functype/cli and dynamically imports it from the new location. Any code at module level in the attacker's file runs at import time, inside the MCP server process. The advisory sets out the data flow across six points in the source, from the tool registration through to the dynamic import.

The advisory also notes that the tool is enabled by default and that no authentication is required when the server runs in stdio mode, the transport in which an MCP server is launched as a local subprocess by its client.

A full proof of concept is published with the advisory. It creates a directory containing a minimal package whose cli.js writes a file to disk, builds the affected monorepo at tag v1.4.3, then connects with a standard MCP client and calls set_functype_version with the argument file:/tmp/evil. The advisory says the exploit was also confirmed dynamically in a Docker container, which reported that the marker file had been created with the expected contents, described as proof of end-to-end RCE.

The recommended remediation in the advisory is to validate the version string against a strict regular expression that permits only dist-tags such as latest, next, beta, alpha, canary and rc, or a semver-style number with optional prerelease and build metadata, and to reject any value containing a slash, colon, backslash or at sign, or surrounding whitespace.

The pattern is a familiar one for agent tooling. A tool that shells out to a package manager gives the model, or anything that can reach the model's tool interface, a route to running code. In this case the parameter was documented as a version number, but nothing in the code enforced that. The advisory does not state whether any deployments were exploited outside the researcher's test environment.