Live › vulnerability › CVE-2026-59176
Go to dashboardThe functype MCP server's set_functype_version tool passes an unvalidated version string to pnpm add, so package aliases such as file:, npm: or URLs install an attacker-chosen package. The server then imports that package, so an attacker runs JavaScript with the server's privileges and can read secrets, modify files or stop the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Teams running the functype MCP server, especially in the default stdio mode where any connected MCP client or an AI assistant reading untrusted content can call the tool without authentication. The httpStream transport is non-default but lets network attackers reach the flaw directly. Teams that do not run functype-mcp-server can skip this.
No product ranges from the sources yet.
pnpm list functype or inspect the functype-mcp-server package version in the project to see if it is below 1.4.4TRANSPORT_TYPE=httpStream, which exposes it to the network1.4.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the set_functype_version MCP tool in functype-mcp-server accepts an unconstrained version string using only z.string() validation in packages/mcp-server/src/index.ts and interpolates it into functype@<version> for pnpm add. Package-alias syntaxes such as file:, npm:, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, initDocsData(true) in packages/mcp-server/src/lib/docs/data.ts resolves functype/cli and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a tools/call request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in stdio mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default TRANSPORT_TYPE=httpStream deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in version 1.4.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-59176")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.