Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

{
  "id": "49583bf4fd8cb72df9d29fa33ff74294fe6e45c0e4168195a8a9bf60f16b7e42",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-59176",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import",
    "summary": "Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in `version` 1.4.4.",
    "evidence": "cve:CVE-2026-59176",
    "products": [
      {
        "name": {
          "value": "functype",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-59176",
      "aliases": [
        "CVE-2026-59176"
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 7.8,
            "attackVector": "LOCAL",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "integrityImpact": "HIGH",
            "userInteraction": "REQUIRED",
            "attackComplexity": "LOW",
            "availabilityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "HIGH"
          }
        }
      ],
      "affected": [
        {
          "vendor": "jordanburke",
          "product": "functype",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.4.4"
            }
          ]
        }
      ],
      "modified": "2026-10-28T13:08:52.592Z",
      "provider": "cve",
      "references": [
        "https://github.com/jordanburke/functype/security/advisories/GHSA-wcjj-9m6g-2fr2",
        "https://github.com/jordanburke/functype/commit/c0d58ad9c2a7d15c6117bd3adbbd75de37317dcf",
        "https://github.com/jordanburke/functype/releases/tag/v1.4.4"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
          "shortName": "GitHub_M",
          "dateUpdated": "2026-10-28T13:08:52.592Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-59176",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 443601,
  "published_at": "2026-10-28T13:08:52.592+00:00"
}